mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-07-10 01:29:59 +00:00
320 lines
No EOL
11 KiB
Text
320 lines
No EOL
11 KiB
Text
# ThreeOpFunc1 inputs are three numbers and returns a number.
|
|
.ThreeOpFunc1->interlocked_compare_exchange
|
|
|
|
# ThreeOpFunc2 inputs are three numbers and returns no value.
|
|
.ThreeOpFunc2->event_inject_error_code memcpy memcpy_pa
|
|
|
|
# TwoOpFunc1 inputs are two numbers and returns a number.
|
|
.TwoOpFunc1->ed eb eq interlocked_exchange interlocked_exchange_add eb_pa ed_pa eq_pa
|
|
|
|
# TwoOpFunc2 inputs are two numbers and returns no value
|
|
.TwoOpFunc2->spinlock_lock_custom_wait event_inject
|
|
|
|
# OneOpFunc1 input is a number and returns a number.
|
|
.OneOpFunc1->poi db dd dw dq neg hi low not check_address disassemble_len disassemble_len32 disassemble_len64 interlocked_increment interlocked_decrement reference physical_to_virtual virtual_to_physical poi_pa hi_pa low_pa db_pa dd_pa dw_pa dq_pa lbr_restore_by_filter
|
|
|
|
# OneOpFunc2 input is a number.
|
|
.OneOpFunc2->print formats event_enable event_disable event_clear test_statement spinlock_lock spinlock_unlock event_sc microsleep
|
|
|
|
# OneOpFunc3 input is a number or a string and returns a number.
|
|
.OneOpFunc3->strlen
|
|
|
|
# TwoOpFunc3 the two inputs are numbers or strings and returns a number.
|
|
.TwoOpFunc3->strcmp
|
|
|
|
# ThreeOpFunc3 the first two inputs are numbers or strings and the third input is a number and returns a number.
|
|
.ThreeOpFunc3->memcmp strncmp
|
|
|
|
# ThreeOpFunc4 the first two inputs are numbers or wstrings and the third input is a number and returns a number.
|
|
.ThreeOpFunc4->wcsncmp
|
|
|
|
# OneOpFunc4 input is a number or a wstring and returns a number.
|
|
.OneOpFunc4->wcslen
|
|
|
|
|
|
# TwoOpFunc4 the two inputs are numbers or wstrings and returns a number.
|
|
.TwoOpFunc4->wcscmp
|
|
|
|
.ZeroOpFunc1->pause flush event_trace_step event_trace_step_in event_trace_step_out event_trace_instrumentation_step event_trace_instrumentation_step_in
|
|
|
|
# ZeroOpFunc2 no input and returns a number
|
|
.ZeroOpFunc2->rdtsc rdtscp lbr_save lbr_dump lbr_print lbr_restore lbr_check
|
|
|
|
.VarArgFunc1->printf
|
|
|
|
.OperatorsTwoOperand->or xor and asr asl add sub mul div mod gt lt egt elt equal neq
|
|
.OperatorsOneOperand->inc dec reference
|
|
|
|
.AssignmentOperator->add_assignment sub_assignment mul_assignment div_assignment mod_assignment asl_assignment asr_assignment and_assignment xor_assignment or_assignment
|
|
|
|
.SemantiRules->jmp jz jnz mov start_of_do_while start_of_do_while_commands end_of_do_while start_of_for for_inc_dec start_of_for_ommands end_of_if ignore_lvalue push pop call ret
|
|
|
|
.Registers->rax eax ax ah al rcx ecx cx ch cl rdx edx dx dh dl rbx ebx bx bh bl rsp esp sp spl rbp ebp bp bpl rsi esi si sil rdi edi di dil r8 r8d r8w r8h r8l r9 r9d r9w r9h r9l r10 r10d r10w r10h r10l r11 r11d r11w r11h r11l r12 r12d r12w r12h r12l r13 r13d r13w r13h r13l r14 r14d r14w r14h r14l r15 r15d r15w r15h r15l ds es fs gs cs ss rflags eflags flags cf pf af zf sf tf if df of iopl nt rf vm ac vif vip id rip eip ip idtr ldtr gdtr tr cr0 cr2 cr3 cr4 cr8 dr0 dr1 dr2 dr3 dr6 dr7
|
|
|
|
.PseudoRegisters->pid tid pname core proc thread peb teb ip buffer context event_tag event_id event_stage date time
|
|
|
|
S->STATEMENT S
|
|
S->{ STATEMENT S }
|
|
S->eps
|
|
|
|
STATEMENT->IF_STATEMENT
|
|
STATEMENT->WHILE_STATEMENT
|
|
STATEMENT->DO_WHILE_STATEMENT
|
|
STATEMENT->FOR_STATEMENT
|
|
STATEMENT->ASSIGNMENT_STATEMENT ;
|
|
STATEMENT->@PUSH _function_id ( VA2 ) @END_OF_CALLING_USER_DEFINED_FUNCTION_WITHOUT_RETURNING_VALUE ;
|
|
STATEMENT->CALL_FUNC_STATEMENT ;
|
|
STATEMENT->break @BREAK ;
|
|
STATEMENT->continue @CONTINUE ;
|
|
STATEMENT->VARIABLE_TYPE3
|
|
STATEMENT->#include STRING @INCLUDE ;
|
|
|
|
|
|
S2->STATEMENT2 S2
|
|
S2->{ STATEMENT2 S2 }
|
|
S2->eps
|
|
|
|
STATEMENT2->IF_STATEMENT
|
|
STATEMENT2->WHILE_STATEMENT
|
|
STATEMENT2->DO_WHILE_STATEMENT
|
|
STATEMENT2->FOR_STATEMENT
|
|
STATEMENT2->ASSIGNMENT_STATEMENT ;
|
|
STATEMENT2->@PUSH _function_id ( VA2 ) @END_OF_CALLING_USER_DEFINED_FUNCTION_WITHOUT_RETURNING_VALUE ;
|
|
STATEMENT2->CALL_FUNC_STATEMENT ;
|
|
STATEMENT2->break @BREAK ;
|
|
STATEMENT2->continue @CONTINUE ;
|
|
STATEMENT2->VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE = EXPRESSION MULTIPLE_ASSIGNMENT ;
|
|
STATEMENT2->return RETURN ;
|
|
|
|
RETURN->eps @RETURN_OF_USER_DEFINED_FUNCTION_WITHOUT_VALUE
|
|
RETURN->EXPRESSION @RETURN_OF_USER_DEFINED_FUNCTION_WITH_VALUE
|
|
|
|
.ScriptVariableType->void bool char short int long unsigned signed float double
|
|
VARIABLE_TYPE1->@PUSH _script_variable_type
|
|
|
|
VARIABLE_TYPE2->VARIABLE_TYPE1 VARIABLE_TYPE2
|
|
VARIABLE_TYPE2->* @DECLARE_POINTER_TYPE
|
|
VARIABLE_TYPE2->eps
|
|
|
|
VARIABLE_TYPE3->VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE VARIABLE_TYPE4
|
|
VARIABLE_TYPE4->= EXPRESSION MULTIPLE_ASSIGNMENT ;
|
|
|
|
VARIABLE_TYPE4->@ARRAY_L_VALUE ARRAY_DIMS = ARRAY_INIT @ARRAY_DECLARITION ;
|
|
|
|
ARRAY_DIMS->[ CONST_NUMBER @ARRAY_DIM_NUMBER ] ARRAY_DIMS2
|
|
ARRAY_DIMS2->ARRAY_DIMS
|
|
ARRAY_DIMS2->eps
|
|
|
|
ARRAY_INIT->{ INIT_LIST } @ARRAY_LEFT_BRACKET
|
|
|
|
INIT_LIST->INIT_ITEM INIT_LIST_TAIL
|
|
|
|
INIT_ITEM->ARRAY_INIT
|
|
INIT_ITEM->EXPRESSION
|
|
|
|
INIT_LIST_TAIL->, INIT_LIST_CONT
|
|
INIT_LIST_TAIL->eps
|
|
|
|
INIT_LIST_CONT->INIT_ITEM INIT_LIST_TAIL
|
|
INIT_LIST_CONT->eps
|
|
|
|
|
|
|
|
|
|
|
|
# define function
|
|
VARIABLE_TYPE4->@START_OF_USER_DEFINED_FUNCTION ( VARIABLE_TYPE5 ) { S2 @END_OF_USER_DEFINED_FUNCTION }
|
|
|
|
VARIABLE_TYPE5->eps
|
|
VARIABLE_TYPE5->VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE @FUNCTION_PARAMETER VARIABLE_TYPE6
|
|
VARIABLE_TYPE6->, VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE @FUNCTION_PARAMETER VARIABLE_TYPE6
|
|
VARIABLE_TYPE6->eps
|
|
|
|
ASSIGNMENT_STATEMENT->* L_VALUE = EXPRESSION @DEREFERENCE
|
|
|
|
ASSIGNMENT_STATEMENT->L_VALUE ARRAY_DIMS_WRITE_OPT ASSIGNMENT_STATEMENT'
|
|
|
|
ARRAY_DIMS_WRITE_OPT->ARRAY_DIMS_WRITE
|
|
ARRAY_DIMS_WRITE_OPT->eps
|
|
|
|
ARRAY_DIMS_WRITE->[ EXPRESSION @ARRAY_DIM_NUMBER ] ARRAY_DIMS_WRITE2
|
|
ARRAY_DIMS_WRITE2->ARRAY_DIMS_WRITE
|
|
ARRAY_DIMS_WRITE2->eps @ARRAY_INDEX_WRITE
|
|
|
|
|
|
|
|
ASSIGNMENT_STATEMENT'->++ @INC
|
|
ASSIGNMENT_STATEMENT'->-- @DEC
|
|
ASSIGNMENT_STATEMENT'->= EXPRESSION MULTIPLE_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'->+= EXPRESSION @ADD_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'->-= EXPRESSION @SUB_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'->*= EXPRESSION @MUL_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'->/= EXPRESSION @DIV_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'->%= EXPRESSION @MOD_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'-><<= EXPRESSION @ASL_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'->>>= EXPRESSION @ASR_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'->&= EXPRESSION @AND_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'->^= EXPRESSION @XOR_ASSIGNMENT
|
|
ASSIGNMENT_STATEMENT'->|= EXPRESSION @OR_ASSIGNMENT
|
|
|
|
|
|
|
|
|
|
|
|
CALL_FUNC_STATEMENT->.OneOpFunc2 ( EXPRESSION @.OneOpFunc2 )
|
|
CALL_FUNC_STATEMENT->.VarArgFunc1 ( STRING @VARGSTART VA @.VarArgFunc1 )
|
|
CALL_FUNC_STATEMENT->.ZeroOpFunc1 ( @.ZeroOpFunc1 )
|
|
CALL_FUNC_STATEMENT->.ZeroOpFunc2 ( @.ZeroOpFunc2 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.TwoOpFunc2 ( EXPRESSION , EXPRESSION @.TwoOpFunc2 )
|
|
CALL_FUNC_STATEMENT->.OneOpFunc1 ( EXPRESSION @.OneOpFunc1 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.TwoOpFunc1 ( EXPRESSION , EXPRESSION @.TwoOpFunc1 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.ThreeOpFunc1 ( EXPRESSION , EXPRESSION , EXPRESSION @.ThreeOpFunc1 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.OneOpFunc3 ( StringNumber @.OneOpFunc3 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.TwoOpFunc3 ( StringNumber , StringNumber @.TwoOpFunc3 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.ThreeOpFunc3 ( StringNumber , StringNumber , EXPRESSION @.ThreeOpFunc3 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.OneOpFunc4 ( WstringNumber @.OneOpFunc4 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.TwoOpFunc4 ( WstringNumber , WstringNumber @.TwoOpFunc4 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.ThreeOpFunc2 ( EXPRESSION , EXPRESSION , EXPRESSION @.ThreeOpFunc2 )
|
|
CALL_FUNC_STATEMENT->.ThreeOpFunc4 ( WstringNumber , WstringNumber , EXPRESSION @.ThreeOpFunc4 ) @IGNORE_LVALUE
|
|
|
|
VA->, EXPRESSION VA
|
|
VA->eps
|
|
|
|
IF_STATEMENT->if @START_OF_IF ( BOOLEAN_EXPRESSION ) @JZ { S2 } ELSIF_STATEMENT ELSE_STATEMENT @END_OF_IF END_OF_IF
|
|
ELSIF_STATEMENT->elsif @JMP_TO_END_AND_JZCOMPLETED ( BOOLEAN_EXPRESSION ) @JZ { S2 } ELSIF_STATEMENT
|
|
ELSIF_STATEMENT->@JMP_TO_END_AND_JZCOMPLETED ELSIF_STATEMENT'
|
|
ELSIF_STATEMENT'->eps
|
|
ELSE_STATEMENT->else { S2 }
|
|
ELSE_STATEMENT->eps
|
|
END_OF_IF->eps
|
|
|
|
|
|
|
|
WHILE_STATEMENT->while @START_OF_WHILE ( BOOLEAN_EXPRESSION ) @START_OF_WHILE_COMMANDS { S2 @END_OF_WHILE }
|
|
DO_WHILE_STATEMENT->do @START_OF_DO_WHILE { S2 } while ( BOOLEAN_EXPRESSION ) @END_OF_DO_WHILE ;
|
|
|
|
FOR_STATEMENT->for ( SIMPLE_ASSIGNMENT ; @START_OF_FOR BOOLEAN_EXPRESSION ; @FOR_INC_DEC INC_DEC ) { @START_OF_FOR_COMMANDS S2 @END_OF_FOR }
|
|
SIMPLE_ASSIGNMENT->VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE = EXPRESSION MULTIPLE_ASSIGNMENT
|
|
SIMPLE_ASSIGNMENT->L_VALUE = EXPRESSION MULTIPLE_ASSIGNMENT
|
|
SIMPLE_ASSIGNMENT->eps
|
|
|
|
|
|
INC_DEC->L_VALUE INC_DEC'
|
|
INC_DEC'->++ @INC
|
|
INC_DEC'->-- @DEC
|
|
INC_DEC'->= EXPRESSION MULTIPLE_ASSIGNMENT
|
|
INC_DEC'->+= EXPRESSION @ADD_ASSIGNMENT
|
|
INC_DEC'->-= EXPRESSION @SUB_ASSIGNMENT
|
|
INC_DEC'->*= EXPRESSION @MUL_ASSIGNMENT
|
|
INC_DEC'->/= EXPRESSION @DIV_ASSIGNMENT
|
|
INC_DEC'->%= EXPRESSION @MOD_ASSIGNMENT
|
|
INC_DEC'-><<= EXPRESSION @ASL_ASSIGNMENT
|
|
INC_DEC'->>>= EXPRESSION @ASR_ASSIGNMENT
|
|
INC_DEC'->&= EXPRESSION @AND_ASSIGNMENT
|
|
INC_DEC'->^= EXPRESSION @XOR_ASSIGNMENT
|
|
INC_DEC'->|= EXPRESSION @OR_ASSIGNMENT
|
|
INC_DEC'->eps
|
|
|
|
BOOLEAN_EXPRESSION->eps
|
|
|
|
MULTIPLE_ASSIGNMENT->eps @MOV
|
|
MULTIPLE_ASSIGNMENT->= EXPRESSION MULTIPLE_ASSIGNMENT2
|
|
MULTIPLE_ASSIGNMENT2->= EXPRESSION MULTIPLE_ASSIGNMENT2
|
|
MULTIPLE_ASSIGNMENT2->eps @MULTIPLE_ASSIGNMENT
|
|
|
|
|
|
|
|
EXPRESSION->E1 E0'
|
|
E0'->| E1 @OR E0'
|
|
E0'->eps
|
|
|
|
|
|
E1->E2 E1'
|
|
E1'->^ E2 @XOR E1'
|
|
E1'->eps
|
|
|
|
E2->E3 E2'
|
|
E2'->& E3 @AND E2'
|
|
E2'->eps
|
|
|
|
E3->E4 E3'
|
|
E3'->>> E4 @ASR E3'
|
|
E3'-><< E4 @ASL E3'
|
|
E3'->eps
|
|
|
|
|
|
|
|
E4->E5 E4'
|
|
E4'->+ E5 @ADD E4'
|
|
E4'->- E5 @SUB E4'
|
|
E4'->eps
|
|
|
|
E5->E12 E5'
|
|
E5'->/ E12 @DIV E5'
|
|
E5'->% E12 @MOD E5'
|
|
E5'->* E12 @MUL E5'
|
|
E5'->eps
|
|
|
|
|
|
|
|
E12->.ZeroOpFunc2 ( @.ZeroOpFunc2 )
|
|
E12->.OneOpFunc1 ( EXPRESSION @.OneOpFunc1 )
|
|
E12->.TwoOpFunc1 ( EXPRESSION , EXPRESSION @.TwoOpFunc1 )
|
|
E12->.ThreeOpFunc1 ( EXPRESSION , EXPRESSION , EXPRESSION @.ThreeOpFunc1 )
|
|
E12->.OneOpFunc3 ( StringNumber @.OneOpFunc3 )
|
|
E12->.TwoOpFunc3 ( StringNumber , StringNumber @.TwoOpFunc3 )
|
|
E12->.ThreeOpFunc3 ( StringNumber , StringNumber , EXPRESSION @.ThreeOpFunc3 )
|
|
E12->.OneOpFunc4 ( WstringNumber @.OneOpFunc4 )
|
|
E12->.TwoOpFunc4 ( WstringNumber , WstringNumber @.TwoOpFunc4 )
|
|
E12->.ThreeOpFunc4 ( WstringNumber , WstringNumber , EXPRESSION @.ThreeOpFunc4 )
|
|
|
|
E12->( EXPRESSION )
|
|
|
|
E12->L_VALUE ARRAY_DIMS_READ_OPT
|
|
E12->@PUSH _function_id ( VA2 ) @END_OF_CALLING_USER_DEFINED_FUNCTION_WITH_RETURNING_VALUE
|
|
|
|
ARRAY_DIMS_READ_OPT->ARRAY_DIMS_READ
|
|
ARRAY_DIMS_READ_OPT->eps
|
|
|
|
ARRAY_DIMS_READ->[ EXPRESSION @ARRAY_DIM_NUMBER ] ARRAY_DIMS_READ2
|
|
ARRAY_DIMS_READ2->ARRAY_DIMS_READ
|
|
ARRAY_DIMS_READ2->eps @ARRAY_INDEX_READ
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# numbers
|
|
CONST_NUMBER->@PUSH _hex
|
|
CONST_NUMBER->@PUSH _decimal
|
|
CONST_NUMBER->@PUSH _octal
|
|
CONST_NUMBER->@PUSH _binary
|
|
|
|
E12->CONST_NUMBER
|
|
|
|
E12->@PUSH _pseudo_register
|
|
|
|
E12->- E12 @NEG
|
|
E12->+ E12
|
|
E12->~ E12 @NOT
|
|
E12->* E12 @POI
|
|
E12->& E12 @REFERENCE
|
|
|
|
# Types must have '_' at the first
|
|
STRING->@PUSH _string
|
|
WSTRING->@PUSH _wstring
|
|
L_VALUE->@PUSH _global_id
|
|
L_VALUE->@PUSH _local_id
|
|
L_VALUE->@PUSH _register
|
|
L_VALUE->@PUSH _function_parameter_id
|
|
|
|
VA2->eps
|
|
VA2->EXPRESSION VA3
|
|
VA3->, EXPRESSION VA3
|
|
VA3->eps
|
|
|
|
StringNumber->EXPRESSION
|
|
StringNumber->STRING
|
|
WstringNumber->EXPRESSION
|
|
WstringNumber->WSTRING |