jitter.h File Reference

Go to the source code of this file.

Data Structures

struct binary_stream

A stream of X86 binary code. More...

struct JIT_BPF_Filter

Structure describing a x86 filtering program created by the jitter. More...

Defines

#define EAX   0

#define ECX   1

#define EDX   2

#define EBX   3

#define ESP   4

#define EBP   5

#define ESI   6

#define EDI   7

#define AX   0

#define CX   1

#define DX   2

#define BX   3

#define SP   4

#define BP   5

#define SI   6

#define DI   7

#define AL   0

#define CL   1

#define DL   2

#define BL   3

#define MOVid(r32, i32)   emitm(&stream, 11 << 4 | 1 << 3 | r32 & 0x7, 1); emitm(&stream, i32, 4);

mov r32,i32

#define MOVrd(dr32, sr32)   emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);

mov dr32,sr32

#define MOVodd(dr32, sr32, off)

mov dr32,sr32[off]

#define MOVobd(dr32, sr32, or32)

mov dr32,sr32[or32]

#define MOVobw(dr32, sr32, or32)

mov dr16,sr32[or32]

#define MOVobb(dr8, sr32, or32)

mov dr8,sr32[or32]

#define MOVomd(dr32, or32, sr32)

mov [dr32][or32],sr32

#define BSWAP(dr32)

bswap dr32

#define SWAP_AX()

xchg al,ah

#define PUSH(r32)   emitm(&stream, 5 << 4 | 0 << 3 | r32 & 0x7, 1);

push r32

#define POP(r32)   emitm(&stream, 5 << 4 | 1 << 3 | r32 & 0x7, 1);

pop r32

#define RET()   emitm(&stream, 12 << 4 | 0 << 3 | 3, 1);

ret

#define ADDrd(dr32, sr32)

add dr32,sr32

#define ADD_EAXi(i32)

add eax,i32

#define ADDid(r32, i32)

add r32,i32

#define ADDib(r32, i8)

add r32,i8

#define SUBrd(dr32, sr32)

sub dr32,sr32

#define SUB_EAXi(i32)

sub eax,i32

#define MULrd(r32)

mul r32

#define DIVrd(r32)

div r32

#define ANDib(r8, i8)

and r8,i8

#define ANDid(r32, i32)

and r32,i32

#define ANDrd(dr32, sr32)

and dr32,sr32

#define ORrd(dr32, sr32)

or dr32,sr32

#define ORid(r32, i32)

or r32,i32

#define SHLib(r32, i8)

shl r32,i8

#define SHL_CLrb(dr32)

shl dr32,cl

#define SHRib(r32, i8)

shr r32,i8

#define SHR_CLrb(dr32)

shr dr32,cl

#define NEGd(r32)

neg r32

#define CMPodd(dr32, sr32, off)

cmp dr32,sr32[off]

#define CMPrd(dr32, sr32)

cmp dr32,sr32

#define CMPid(dr32, i32)

cmp dr32,i32

#define JNEb(off8)

jne off32

#define JE(off32)

je off32

#define JLE(off32)

jle off32

#define JLEb(off8)

jle off8

#define JA(off32)

ja off32

#define JAE(off32)

jae off32

#define JG(off32)

jg off32

#define JGE(off32)

jge off32

#define JMP(off32)

jmp off32

Typedefs

typedef UINT(__cdecl *) BPF_filter_function (PVOID *, ULONG, UINT)

Prototype of a filtering function created by the jitter.

typedef void(*) emit_func (binary_stream *stream, ULONG value, UINT n)

Prototype of the emit functions.

Functions

JIT_BPF_Filter * BPF_jitter (struct bpf_insn *fp, INT nins)

BPF jitter, builds an x86 function from a BPF program.

BPF_filter_function BPFtoX86 (struct bpf_insn *ins, UINT nins, INT *mem)

Translates a set of BPF instructions in a set of x86 ones.

void BPF_Destroy_JIT_Filter (JIT_BPF_Filter *Filter)

Deletes a filtering function that was previously created by BPF_jitter().


Data Structures
struct	binary_stream
	A stream of X86 binary code. More...
struct	JIT_BPF_Filter
	Structure describing a x86 filtering program created by the jitter. More...
Defines
#define	EAX 0
#define	ECX 1
#define	EDX 2
#define	EBX 3
#define	ESP 4
#define	EBP 5
#define	ESI 6
#define	EDI 7
#define	AX 0
#define	CX 1
#define	DX 2
#define	BX 3
#define	SP 4
#define	BP 5
#define	SI 6
#define	DI 7
#define	AL 0
#define	CL 1
#define	DL 2
#define	BL 3
#define	MOVid(r32, i32) emitm(&stream, 11 << 4 \| 1 << 3 \| r32 & 0x7, 1); emitm(&stream, i32, 4);
	mov r32,i32
#define	MOVrd(dr32, sr32) emitm(&stream, 8 << 4 \| 3 \| 1 << 3, 1); emitm(&stream, 3 << 6 \| (dr32 & 0x7) << 3 \| sr32 & 0x7, 1);
	mov dr32,sr32
#define	MOVodd(dr32, sr32, off)
	mov dr32,sr32[off]
#define	MOVobd(dr32, sr32, or32)
	mov dr32,sr32[or32]
#define	MOVobw(dr32, sr32, or32)
	mov dr16,sr32[or32]
#define	MOVobb(dr8, sr32, or32)
	mov dr8,sr32[or32]
#define	MOVomd(dr32, or32, sr32)
	mov [dr32][or32],sr32
#define	BSWAP(dr32)
	bswap dr32
#define	SWAP_AX()
	xchg al,ah
#define	PUSH(r32) emitm(&stream, 5 << 4 \| 0 << 3 \| r32 & 0x7, 1);
	push r32
#define	POP(r32) emitm(&stream, 5 << 4 \| 1 << 3 \| r32 & 0x7, 1);
	pop r32
#define	RET() emitm(&stream, 12 << 4 \| 0 << 3 \| 3, 1);
	ret
#define	ADDrd(dr32, sr32)
	add dr32,sr32
#define	ADD_EAXi(i32)
	add eax,i32
#define	ADDid(r32, i32)
	add r32,i32
#define	ADDib(r32, i8)
	add r32,i8
#define	SUBrd(dr32, sr32)
	sub dr32,sr32
#define	SUB_EAXi(i32)
	sub eax,i32
#define	MULrd(r32)
	mul r32
#define	DIVrd(r32)
	div r32
#define	ANDib(r8, i8)
	and r8,i8
#define	ANDid(r32, i32)
	and r32,i32
#define	ANDrd(dr32, sr32)
	and dr32,sr32
#define	ORrd(dr32, sr32)
	or dr32,sr32
#define	ORid(r32, i32)
	or r32,i32
#define	SHLib(r32, i8)
	shl r32,i8
#define	SHL_CLrb(dr32)
	shl dr32,cl
#define	SHRib(r32, i8)
	shr r32,i8
#define	SHR_CLrb(dr32)
	shr dr32,cl
#define	NEGd(r32)
	neg r32
#define	CMPodd(dr32, sr32, off)
	cmp dr32,sr32[off]
#define	CMPrd(dr32, sr32)
	cmp dr32,sr32
#define	CMPid(dr32, i32)
	cmp dr32,i32
#define	JNEb(off8)
	jne off32
#define	JE(off32)
	je off32
#define	JLE(off32)
	jle off32
#define	JLEb(off8)
	jle off8
#define	JA(off32)
	ja off32
#define	JAE(off32)
	jae off32
#define	JG(off32)
	jg off32
#define	JGE(off32)
	jge off32
#define	JMP(off32)
	jmp off32
Typedefs
typedef UINT(__cdecl *)	BPF_filter_function (PVOID *, ULONG, UINT)
	Prototype of a filtering function created by the jitter.
typedef void(*)	emit_func (binary_stream *stream, ULONG value, UINT n)
	Prototype of the emit functions.
Functions
JIT_BPF_Filter *	BPF_jitter (struct bpf_insn *fp, INT nins)
	BPF jitter, builds an x86 function from a BPF program.
BPF_filter_function	BPFtoX86 (struct bpf_insn ins, UINT nins, INT mem)
	Translates a set of BPF instructions in a set of x86 ones.
void	BPF_Destroy_JIT_Filter (JIT_BPF_Filter *Filter)
	Deletes a filtering function that was previously created by BPF_jitter().