github/ghidra
1
1
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-01-10 14:38:02 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch

Browse Source 
'origin/GP-5593_ghidorahrex_PR-7985_niooss-ledger_ebpf-fix-semantic-byte-swap-instructions'
into patch (Closes #7985)
This commit is contained in:
Ryan Kurtz
2025-07-29 08:19:00 -04:00
parent 28b46c5c93 adb0eac98a
commit 179263a592
6 changed files with 84 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Ghidra/Processors/eBPF/certification.manifest
View File

@@ -7,4 +7,5 @@ data/languages/eBPF.ldefs||GHIDRA||||END|
data/languages/eBPF.opinion||GHIDRA||||END|
data/languages/eBPF.pspec||GHIDRA||||END|
data/languages/eBPF.sinc||GHIDRA||||END|
data/languages/eBPF_be.slaspec||GHIDRA||||END|
data/languages/eBPF_le.slaspec||GHIDRA||||END|

14
Ghidra/Processors/eBPF/data/languages/eBPF.ldefs
View File

@@ -1,5 +1,17 @@
<?xml version="1.0" encoding="UTF-8"?>
<language_definitions>
<language processor="eBPF"
endian="big"
size="64"
variant="default"
version="1.0"
slafile="eBPF_be.sla"
processorspec="eBPF.pspec"
id="eBPF:BE:64:default">
<description>eBPF processor 64-bit big-endian</description>
<compiler name="default" spec="eBPF.cspec" id="default"/>
<external_name tool="DWARF.register.mapping.file" name="eBPF.dwarf"/>
</language>
<language processor="eBPF"
endian="little"
size="64"
@@ -10,6 +22,6 @@
id="eBPF:LE:64:default">
<description>eBPF processor 64-bit little-endian</description>
<compiler name="default" spec="eBPF.cspec" id="default"/>
<external_name tool="DWARF.register.mapping.file" name="eBPF.dwarf"/>
<external_name tool="DWARF.register.mapping.file" name="eBPF.dwarf"/>
</language>
</language_definitions>

1
Ghidra/Processors/eBPF/data/languages/eBPF.opinion
View File

@@ -1,5 +1,6 @@
<opinions>
<constraint loader="Executable and Linking Format (ELF)" compilerSpecID="default">
<constraint primary="247" processor="eBPF" endian="big" size="64" />
<constraint primary="247" processor="eBPF" endian="little" size="64" />
</constraint>
</opinions>

89
Ghidra/Processors/eBPF/data/languages/eBPF.sinc
View File

@@ -2,6 +2,8 @@
# eBPF Processor Specification for Ghidra
###############################################################################
define endian=$(ENDIAN);
#eBPF is a RISC register machine with a total of 11 64-bit registers, a program counter and a 512 byte fixed-size stack.
#9 registers are general purpose read-write, one is a read-only stack pointer and the program counter is implicit,
#i.e. we can only jump to a certain offset from it. The eBPF registers are always 64-bit wide.
@@ -13,6 +15,7 @@ define space syscall type=ram_space size=4;
define register offset=0 size=8 [ R0 R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 PC ];
# Instruction encoding: Insop:8, dst_reg:4, src_reg:4, off:16, imm:32 - from lsb to msb
@if ENDIAN == "little"
define token instr(64)
imm=(32, 63) signed
off=(16, 31) signed
@@ -27,8 +30,25 @@ define token instr(64)
#We'll need this token to operate with LDDW instruction, which has 64 bit imm value
define token immtoken(64)
imm2=(32, 63)
imm2=(32, 63)
;
@else # ENDIAN == "big"
define token instr(64)
imm=(0, 31) signed
off=(32, 47) signed
src=(48, 51)
dst=(52, 55)
op_insn_class=(56, 58)
op_ld_st_size=(59, 60)
op_ld_st_mode=(61, 63)
op_alu_jmp_source=(59, 59)
op_alu_jmp_opcode=(60, 63)
;
define token immtoken(64)
imm2=(0, 31)
;
@endif # ENDIAN = "big"
#To operate with registers
attach variables [ src dst ] [ R0 R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 _ _ _ _ _ ];
@@ -104,34 +124,55 @@ DST4: dst is dst { local tmp:4 = dst:4; export tmp; }
#Bytewasp instructions
###############################################################################
@if ENDIAN == "little"
# BPF_ALU | BPF_K | BPF_END
:LE16 dst is imm=0x10 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=0 & op_insn_class=0x4 { dst=((dst) >> 8) | ((dst) << 8); }
:LE32 dst is imm=0x20 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=0 & op_insn_class=0x4 { dst=((dst) >> 24) | (((dst) & 0x00FF0000) >> 8) | (((dst) & 0x0000FF00) << 8) | ((dst) << 24); }
:LE16 dst is imm=0x10 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=0 & op_insn_class=0x4 { dst = zext(dst:2); }
:LE32 dst is imm=0x20 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=0 & op_insn_class=0x4 { dst = zext(dst:4); }
:LE64 dst is imm=0x40 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=0 & op_insn_class=0x4 {}
# BPF_ALU | BPF_X | BPF_END
:BE16 dst is imm=0x10 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=1 & op_insn_class=0x4 {
dst = ((dst & 0xff00) >> 8) | ((dst & 0x00ff) << 8);
}
:BE32 dst is imm=0x20 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=1 & op_insn_class=0x4 {
dst = ((dst & 0xff000000) >> 24) | (((dst) & 0x00ff0000) >> 8) | (((dst) & 0x0000ff00) << 8) | ((dst & 0x000000ff) << 24);
}
:BE64 dst is imm=0x40 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=1 & op_insn_class=0x4 {
dst = ((dst << 56) & 0xff00000000000000) |
((dst << 40) & 0x00ff000000000000) |
((dst << 24) & 0x0000ff0000000000) |
((dst << 8) & 0x000000ff00000000) |
((dst >> 8) & 0x00000000ff000000) |
((dst >> 24) & 0x0000000000ff0000) |
((dst >> 40) & 0x000000000000ff00) |
((dst >> 56) & 0x00000000000000ff);
}
@else # ENDIAN == "big"
# BPF_ALU | BPF_K | BPF_END
:LE16 dst is imm=0x10 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=0 & op_insn_class=0x4 {
dst = ((dst & 0xff00) >> 8) | ((dst & 0x00ff) << 8);
}
:LE32 dst is imm=0x20 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=0 & op_insn_class=0x4 {
dst = ((dst & 0xff000000) >> 24) | (((dst) & 0x00ff0000) >> 8) | (((dst) & 0x0000ff00) << 8) | ((dst & 0x000000ff) << 24);
}
:LE64 dst is imm=0x40 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=0 & op_insn_class=0x4 {
dst=( (dst << 56) & 0xff00000000000000 ) |
( (dst << 40) & 0x00ff000000000000 ) |
( (dst << 24) & 0x0000ff0000000000 ) |
( (dst << 8) & 0x000000ff00000000 ) |
( (dst >> 8) & 0x00000000ff000000 ) |
( (dst >> 24) & 0x0000000000ff0000 ) |
( (dst >> 40) & 0x000000000000ff00 ) |
( (dst >> 56) & 0x00000000000000ff );
dst = ((dst << 56) & 0xff00000000000000) |
((dst << 40) & 0x00ff000000000000) |
((dst << 24) & 0x0000ff0000000000) |
((dst << 8) & 0x000000ff00000000) |
((dst >> 8) & 0x00000000ff000000) |
((dst >> 24) & 0x0000000000ff0000) |
((dst >> 40) & 0x000000000000ff00) |
((dst >> 56) & 0x00000000000000ff);
}
# BPF_ALU | BPF_X | BPF_END
:BE16 dst is imm=0x10 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=1 & op_insn_class=0x4 { dst=((dst) >> 8) | ((dst) << 8); }
:BE32 dst is imm=0x20 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=1 & op_insn_class=0x4 { dst=((dst) >> 24) | (((dst) & 0x00FF0000) >> 8) | (((dst) & 0x0000FF00) << 8) | ((dst) << 24); }
:BE64 dst is imm=0x40 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=1 & op_insn_class=0x4 {
dst=( (dst << 56) & 0xff00000000000000 ) |
( (dst << 40) & 0x00ff000000000000 ) |
( (dst << 24) & 0x0000ff0000000000 ) |
( (dst << 8) & 0x000000ff00000000 ) |
( (dst >> 8) & 0x00000000ff000000 ) |
( (dst >> 24) & 0x0000000000ff0000 ) |
( (dst >> 40) & 0x000000000000ff00 ) |
( (dst >> 56) & 0x00000000000000ff );
}
:BE16 dst is imm=0x10 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=1 & op_insn_class=0x4 { dst = zext(dst:2); }
:BE32 dst is imm=0x20 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=1 & op_insn_class=0x4 { dst = zext(dst:4); }
:BE64 dst is imm=0x40 & dst & op_alu_jmp_opcode=0xd & op_alu_jmp_source=1 & op_insn_class=0x4 {}
@endif # ENDIAN = "big"
#Memory instructions - Load and Store
###############################################################################

3
Ghidra/Processors/eBPF/data/languages/eBPF_be.slaspec Normal file
View File

@@ -0,0 +1,3 @@
@define ENDIAN "big"
@include "eBPF.sinc"

2
Ghidra/Processors/eBPF/data/languages/eBPF_le.slaspec
View File

@@ -1,3 +1,3 @@
define endian=little;
@define ENDIAN "little"
@include "eBPF.sinc"