[Pkg-clamav-commits] [SCM] Debian repository for ClamAV branch, debian/unstable, updated. debian/0.95+dfsg-1-6156-g094ec9b
Török Edvin
edwin at clamav.net
Sun Apr 4 01:09:49 UTC 2010
The following commit has been merged in the debian/unstable branch:
commit b54e540e46901dda40c59214fb8fe3fe83af4f07
Author: Török Edvin <edwin at clamav.net>
Date: Thu Nov 26 21:15:42 2009 +0200
missing file.
diff --git a/libclamav/disasm-common.h b/libclamav/disasm-common.h
new file mode 100644
index 0000000..cbe4273
--- /dev/null
+++ b/libclamav/disasm-common.h
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) 2008 Sourcefire, Inc.
+ *
+ * Authors: Török Edvin
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA 02110-1301, USA.
+ */
+
+#ifndef DISASM_BC_H
+#define DISASM_BC_H
+/** @file */
+/** X86 opcode */
+enum X86OPS {
+ OP_INVALID,
+ OP_AAA,/**< Ascii Adjust after Addition */
+ OP_AAD,/**< Ascii Adjust AX before Division */
+ OP_AAM,/**< Ascii Adjust AX after Multiply */
+ OP_AAS,/**< Ascii Adjust AL after Subtraction */
+ OP_ADD,/**< Add */
+ OP_ADC,/**< Add with Carry */
+ OP_AND,/**< Logical And */
+ OP_ARPL,/**< Adjust Requested Privilege Level */
+ OP_BOUND,/**< Check Array Index Against Bounds */
+ OP_BSF,/**< Bit Scan Forward */
+ OP_BSR,/**< Bit Scan Reverse */
+ OP_BSWAP,/**< Byte Swap */
+ OP_BT,/**< Bit Test */
+ OP_BTC,/**< Bit Test and Complement */
+ OP_BTR,/**< Bit Test and Reset */
+ OP_BTS,/**< Bit Test and Set */
+ OP_CALL,/**< Call */
+ OP_CDQ,/**< Convert DoubleWord to QuadWord*/
+ OP_CWD,
+ OP_CWDE,/**< Convert Word to DoubleWord */
+ OP_CBW,/**< Convert Byte to Word */
+ OP_CLC,/**< Clear Carry Flag */
+ OP_CLD,/**< Clear Direction Flag */
+ OP_CLI,/**< Clear Interrupt Flag */
+ OP_CLTS,/**< Clear Task-Switched Flag in CR0 */
+ OP_CMC,/**< Complement Carry Flag */
+ OP_CMOVO,/**< Conditional Move if Overflow */
+ OP_CMOVNO,/**< Conditional Move if Not Overflow */
+ OP_CMOVC,/**< Conditional Move if Carry */
+ OP_CMOVNC,/**< Conditional Move if Not Carry */
+ OP_CMOVZ,/**< Conditional Move if Zero */
+ OP_CMOVNZ,/**< Conditional Move if Non-Zero */
+ OP_CMOVBE,/**< Conditional Move if Below or Equal */
+ OP_CMOVA,/**< Conditional Move if Above */
+ OP_CMOVS,/**< Conditional Move if Sign */
+ OP_CMOVNS,/**< Conditional Move if Not Sign */
+ OP_CMOVP,/**< Conditional Move if Parity */
+ OP_CMOVNP,/**< Conditional Move if Not Parity */
+ OP_CMOVL,/**< Conditional Move if Less */
+ OP_CMOVGE,/**< Conditional Move if Greater or Equal */
+ OP_CMOVLE,/**< Conditional Move if Less than or Equal */
+ OP_CMOVG,/**< Conditional Move if Greater */
+ OP_CMP,/**< Compare */
+ OP_CMPSD,/**< Compare String DoubleWord */
+ OP_CMPSW,/**< Compare String Word */
+ OP_CMPSB,/**< Compare String Byte */
+ OP_CMPXCHG,/**< Compare and Exchange */
+ OP_CMPXCHG8B,/**< Compare and Exchange Bytes */
+ OP_CPUID,/**< CPU Identification */
+ OP_DAA,/**< Decimal Adjust AL after Addition */
+ OP_DAS,/**< Decimal Adjust AL after Subtraction */
+ OP_DEC,/**< Decrement by 1 */
+ OP_DIV,/**< Unsigned Divide */
+ OP_ENTER,/**< Make Stack Frame for Procedure Parameters */
+ OP_FWAIT,/**< Wait */
+ OP_HLT,/**< Halt */
+ OP_IDIV,/**< Signed Divide */
+ OP_IMUL,/**< Signed Multiply */
+ OP_INC,/**< Increment by 1 */
+ OP_IN,/**< INput from port */
+ OP_INSD,/**< INput from port to String Doubleword */
+ OP_INSW,/**< INput from port to String Word */
+ OP_INSB,/**< INput from port to String Byte */
+ OP_INT,/**< INTerrupt */
+ OP_INT3,/**< INTerrupt 3 (breakpoint) */
+ OP_INTO,/**< INTerrupt 4 if Overflow */
+ OP_INVD,/**< Invalidate Internal Caches */
+ OP_INVLPG,/**< Invalidate TLB Entry */
+ OP_IRET,/**< Interrupt Return */
+ OP_JO,/**< Jump if Overflow */
+ OP_JNO,/**< Jump if Not Overflow */
+ OP_JC,/**< Jump if Carry */
+ OP_JNC,/**< Jump if Not Carry */
+ OP_JZ,/**< Jump if Zero */
+ OP_JNZ,/**< Jump if Not Zero */
+ OP_JBE,/**< Jump if Below or Equal */
+ OP_JA,/**< Jump if Above */
+ OP_JS,/**< Jump if Sign */
+ OP_JNS,/**< Jump if Not Sign */
+ OP_JP,/**< Jump if Parity */
+ OP_JNP,/**< Jump if Not Parity */
+ OP_JL,/**< Jump if Less */
+ OP_JGE,/**< Jump if Greater or Equal */
+ OP_JLE,/**< Jump if Less or Equal */
+ OP_JG,/**< Jump if Greater */
+ OP_JMP,/**< Jump (unconditional) */
+ OP_LAHF,/**< Load Status Flags into AH Register */
+ OP_LAR,/**< load Access Rights Byte */
+ OP_LDS,/**< Load Far Pointer into DS */
+ OP_LES,/**< Load Far Pointer into ES */
+ OP_LFS,/**< Load Far Pointer into FS */
+ OP_LGS,/**< Load Far Pointer into GS */
+ OP_LEA,/**< Load Effective Address */
+ OP_LEAVE,/**< High Level Procedure Exit */
+ OP_LGDT,/**< Load Global Descript Table Register */
+ OP_LIDT,/**< Load Interrupt Descriptor Table Register */
+ OP_LLDT,/**< Load Local Descriptor Table Register */
+ OP_PREFIX_LOCK,/**< Assert LOCK# Signal Prefix */
+ OP_LODSD,/**< Load String Dword*/
+ OP_LODSW,/**< Load String Word */
+ OP_LODSB,/**< Load String Byte */
+ OP_LOOP,/**< Loop According to ECX Counter */
+ OP_LOOPE,/**< Loop According to ECX Counter and ZF=1 */
+ OP_LOOPNE,/**< Looop According to ECX Counter and ZF=0 */
+ OP_JECXZ,/**< Jump if ECX is Zero */
+ OP_LSL,/**< Load Segment Limit */
+ OP_LSS,/**< Load Far Pointer into SS */
+ OP_LTR,/**< Load Task Register */
+ OP_MOV,/**< Move */
+ OP_MOVSD,/**< Move Data from String to String Doubleword */
+ OP_MOVSW,/**< Move Data from String to String Word */
+ OP_MOVSB,/**< Move Data from String to String Byte */
+ OP_MOVSX,/**< Move with Sign-Extension */
+ OP_MOVZX,/**< Move with Zero-Extension */
+ OP_MUL,/**< Unsigned Multiply */
+ OP_NEG,/**< Two's Complement Negation */
+ OP_NOP,/**< No Operation */
+ OP_NOT,/**< One's Complement Negation */
+ OP_OR,/**< Logical Inclusive OR */
+ OP_OUT,/**< Output to Port */
+ OP_OUTSD,/**< Output String to Port Doubleword */
+ OP_OUTSW,/**< Output String to Port Word */
+ OP_OUTSB,/**< Output String to Port Bytes */
+ OP_PUSH,/**< Push Onto the Stack */
+ OP_PUSHAD,/**< Push All Double General Purpose Registers */
+ OP_PUSHA,
+ OP_PUSHFD,/**< Push EFLAGS Register onto the Stack */
+ OP_PUSHF,
+ OP_POP,/**< Pop a Value from the Stack */
+ OP_POPAD,/**< Pop All Double General Purpose Registers from the Stack */
+ OP_POPFD,/**< Pop Stack into EFLAGS Register */
+ OP_POPF,
+ OP_RCL,/**< Rotate Carry Left */
+ OP_RCR,/**< Rotate Carry Right */
+ OP_RDMSR,/**< Read from Model Specific Register */
+ OP_RDPMC,/**< Read Performance Monitoring Counters */
+ OP_RDTSC,/**< Read Time-Stamp Coutner */
+ OP_PREFIX_REPE,/**< Repeat String Operation Prefix while Equal */
+ OP_PREFIX_REPNE,/**< Repeat String Operation Prefix while Not Equal */
+ OP_RETF,/**< Return from Far Procedure */
+ OP_RETN,/**< Return from Near Procedure */
+ OP_ROL,/**< Rotate Left */
+ OP_ROR,/**< Rotate Right */
+ OP_RSM,/**< Resumse from System Management Mode */
+ OP_SAHF,/**< Store AH into Flags */
+ OP_SAR,/**< Shift Arithmetic Right */
+ OP_SBB,/**< Subtract with Borrow */
+ OP_SCASD,/**< Scan String Doubleword */
+ OP_SCASW,/**< Scan String Word */
+ OP_SCASB,/**< Scan String Byte */
+ OP_SETO,/**< Set Byte on Overflow */
+ OP_SETNO,/**< Set Byte on Not Overflow */
+ OP_SETC,/**< Set Byte on Carry */
+ OP_SETNC,/**< Set Byte on Not Carry */
+ OP_SETZ,/**< Set Byte on Zero */
+ OP_SETNZ,/**< Set Byte on Not Zero */
+ OP_SETBE,/**< Set Byte on Below or Equal */
+ OP_SETA,/**< Set Byte on Above */
+ OP_SETS,/**< Set Byte on Sign */
+ OP_SETNS,/**< Set Byte on Not Sign */
+ OP_SETP,/**< Set Byte on Parity */
+ OP_SETNP,/**< Set Byte on Not Parity */
+ OP_SETL,/**< Set Byte on Less */
+ OP_SETGE,/**< Set Byte on Greater or Equal */
+ OP_SETLE,/**< Set Byte on Less or Equal */
+ OP_SETG,/**< Set Byte on Greater */
+ OP_SGDT,/**< Store Global Descriptor Table Register */
+ OP_SIDT,/**< Store Interrupt Descriptor Table Register */
+ OP_SHL,/**< Shift Left */
+ OP_SHLD,/**< Double Precision Shift Left */
+ OP_SHR,/**< Shift Right */
+ OP_SHRD,/**< Double Precision Shift Right */
+ OP_SLDT,/**< Store Local Descriptor Table Register */
+ OP_STOSD,/**< Store String Doubleword */
+ OP_STOSW,/**< Store String Word */
+ OP_STOSB,/**< Store String Byte */
+ OP_STR,/**< Store Task Register */
+ OP_STC,/**< Set Carry Flag */
+ OP_STD,/**< Set Direction Flag */
+ OP_STI,/**< Set Interrupt Flag */
+ OP_SUB,/**< Subtract */
+ OP_SYSCALL,/**< Fast System Call */
+ OP_SYSENTER,/**< Fast System Call */
+ OP_SYSEXIT,/**< Fast Return from Fast System Call */
+ OP_SYSRET,/**< Return from Fast System Call */
+ OP_TEST,/**< Logical Compare */
+ OP_UD2,/**< Undefined Instruction */
+ OP_VERR,/**< Verify a Segment for Reading */
+ OP_VERRW,/**< Verify a Segment for Writing */
+ OP_WBINVD,/**< Write Back and Invalidate Cache */
+ OP_WRMSR,/**< Write to Model Specific Register */
+ OP_XADD,/**< Exchange and Add */
+ OP_XCHG,/**< Exchange Register/Memory with Register */
+ OP_XLAT,/**< Table Look-up Translation */
+ OP_XOR,/**< Logical Exclusive OR */
+ OP_PREFIX_OPSIZE,
+ OP_PREFIX_ADDRSIZE,
+ OP_PREFIX_SEGMENT,
+ OP_2BYTE,
+
+ OP_FPU,/**< FPU operation */
+
+ OP_F2XM1,/**< Compute 2x-1 */
+ OP_FABS,/**< Absolute Value */
+ OP_FADD,/**< Floating Point Add */
+ OP_FADDP,/**< Floating Point Add, Pop */
+ OP_FBLD,/**< Load Binary Coded Decimal */
+ OP_FBSTP,/**< Store BCD Integer and Pop */
+ OP_FCHS,/**< Change Sign */
+ OP_FCLEX,/**< Clear Exceptions */
+ OP_FCMOVB,/**< Floating Point Move on Below */
+ OP_FCMOVBE,/**< Floating Point Move on Below or Equal */
+ OP_FCMOVE,/**< Floating Point Move on Equal */
+ OP_FCMOVNB,/**< Floating Point Move on Not Below */
+ OP_FCMOVNBE,/**< Floating Point Move on Not Below or Equal */
+ OP_FCMOVNE,/**< Floating Point Move on Not Equal */
+ OP_FCMOVNU,/**< Floating Point Move on Not Unordered */
+ OP_FCMOVU,/**< Floating Point Move on Unordered */
+ OP_FCOM,/**< Compare Floating Pointer Values and Set FPU Flags */
+ OP_FCOMI,/**< Compare Floating Pointer Values and Set EFLAGS */
+ OP_FCOMIP,/**< Compare Floating Pointer Values and Set EFLAGS, Pop */
+ OP_FCOMP,/**< Compare Floating Pointer Values and Set FPU Flags, Pop */
+ OP_FCOMPP,/**< Compare Floating Pointer Values and Set FPU Flags, Pop Twice */
+ OP_FCOS,/**< Cosine */
+ OP_FDECSTP,/**< Decrement Stack Top Pointer */
+ OP_FDIV,/**< Floating Point Divide */
+ OP_FDIVP,/**< Floating Point Divide, Pop */
+ OP_FDIVR,/**< Floating Point Reverse Divide */
+ OP_FDIVRP,/**< Floating Point Reverse Divide, Pop */
+ OP_FFREE,/**< Free Floating Point Register */
+ OP_FIADD,/**< Floating Point Add */
+ OP_FICOM,/**< Compare Integer */
+ OP_FICOMP,/**< Compare Integer, Pop */
+ OP_FIDIV,/**< Floating Point Divide by Integer */
+ OP_FIDIVR,/**< Floating Point Reverse Divide by Integer */
+ OP_FILD,/**< Load Integer */
+ OP_FIMUL,/**< Floating Point Multiply with Integer */
+ OP_FINCSTP,/**< Increment Stack-Top Pointer */
+ OP_FINIT,/**< Initialize Floating-Point Unit */
+ OP_FIST,/**< Store Integer */
+ OP_FISTP,/**< Store Integer, Pop */
+ OP_FISTTP,/**< Store Integer with Truncation */
+ OP_FISUB,/**< Floating Point Integer Subtract */
+ OP_FISUBR,/**< Floating Point Reverse Integer Subtract */
+ OP_FLD,/**< Load Floating Point Value */
+ OP_FLD1,/**< Load Constant 1 */
+ OP_FLDCW,/**< Load x87 FPU Control Word */
+ OP_FLDENV,/**< Load x87 FPU Environment */
+ OP_FLDL2E,/**< Load Constant log_2(e) */
+ OP_FLDL2T,/**< Load Constant log_2(10) */
+ OP_FLDLG2,/**< Load Constant log_10(2) */
+ OP_FLDLN2,/**< Load Constant log_e(2) */
+ OP_FLDPI,/**< Load Constant PI */
+ OP_FLDZ,/**< Load Constant Zero */
+ OP_FMUL,/**< Floating Point Multiply */
+ OP_FMULP,/**< Floating Point Multiply, Pop */
+ OP_FNOP,/**< No Operation */
+ OP_FPATAN,/**< Partial Arctangent */
+ OP_FPREM,/**< Partial Remainder */
+ OP_FPREM1,/**< Partial Remainder */
+ OP_FPTAN,/**< Partial Tangent */
+ OP_FRNDINT,/**< Round to Integer */
+ OP_FRSTOR,/**< Restore x86 FPU State */
+ OP_FSCALE,/**< Scale */
+ OP_FSIN,/* Sine */
+ OP_FSINCOS,/**< Sine and Cosine */
+ OP_FSQRT,/**< Square Root */
+ OP_FSAVE,/**< Store x87 FPU State */
+ OP_FST,/**< Store Floating Point Value */
+ OP_FSTCW,/**< Store x87 FPU Control Word */
+ OP_FSTENV,/**< Store x87 FPU Environment */
+ OP_FSTP,/**< Store Floating Point Value, Pop */
+ OP_FSTSW,/**< Store x87 FPU Status Word */
+ OP_FSUB,/**< Floating Point Subtract */
+ OP_FSUBP,/**< Floating Point Subtract, Pop */
+ OP_FSUBR,/**< Floating Point Reverse Subtract */
+ OP_FSUBRP,/**< Floating Point Reverse Subtract, Pop */
+ OP_FTST,/**< Floating Point Test */
+ OP_FUCOM,/**< Floating Point Unordered Compare */
+ OP_FUCOMI,/**< Floating Point Unordered Compare with Integer */
+ OP_FUCOMIP,/**< Floating Point Unorder Compare with Integer, Pop */
+ OP_FUCOMP,/**< Floating Point Unorder Compare, Pop */
+ OP_FUCOMPP,/**< Floating Point Unorder Compare, Pop Twice */
+ OP_FXAM,/**< Examine ModR/M */
+ OP_FXCH,/**< Exchange Register Contents */
+ OP_FXTRACT,/**< Extract Exponent and Significand */
+ OP_FYL2X,/**< Compute y*log2x */
+ OP_FYL2XP1 /**< Compute y*log2(x+1) */
+};
+
+/** Access type */
+enum DIS_ACCESS {
+ ACCESS_NOARG, /** arg not present */
+ ACCESS_IMM, /** immediate */
+ ACCESS_REL, /** +/- immediate */
+ ACCESS_REG, /** register */
+ ACCESS_MEM /** [memory] */
+};
+
+/** for mem access, immediate and relative */
+enum DIS_SIZE {
+ SIZEB,/**< Byte size access */
+ SIZEW,/**< Word size access */
+ SIZED,/**< Doubleword size access */
+ SIZEF,/**< 6-byte access (seg+reg pair)*/
+ SIZEQ,/**< Quadword access */
+ SIZET,/**< 10-byte access */
+ SIZEPTR /** ptr */
+};
+
+/** X86 registers */
+enum X86REGS {
+ REG_EAX, REG_ECX, REG_EDX, REG_EBX, REG_ESP, REG_EBP, REG_ESI, REG_EDI,
+ REG_AX, REG_CX, REG_DX, REG_BX, REG_SP, REG_BP, REG_SI, REG_DI,
+ REG_AH, REG_CH, REG_DH, REG_BH, REG_AL, REG_CL, REG_DL, REG_BL,
+ REG_ES, REG_CS, REG_SS, REG_DS, REG_FS, REG_GS,
+ REG_CR0, REG_CR1, REG_CR2, REG_CR3, REG_CR4, REG_CR5, REG_CR6, REG_CR7,
+ REG_DR0, REG_DR1, REG_DR2, REG_DR3, REG_DR4, REG_DR5, REG_DR6, REG_DR7,
+ REG_ST0, REG_ST1, REG_ST2, REG_ST3, REG_ST4, REG_ST5, REG_ST6, REG_ST7,
+ REG_INVALID
+};
+
+/** disassembly result, 64-byte, matched by type-8 signatures */
+struct DISASM_RESULT {
+ uint16_t real_op;
+ uint8_t opsize;
+ uint8_t adsize;
+ uint8_t segment;
+ uint8_t arg[3][10];
+ uint8_t extra[29];
+};
+#endif
+
--
Debian repository for ClamAV
More information about the Pkg-clamav-commits
mailing list