NPF Just-in-time compiler definitions
[NPF driver internals manual]

Data Structures

struct  binary_stream
 A stream of X86 binary code. More...
struct  JIT_BPF_Filter
 Structure describing a x86 filtering program created by the jitter. More...

Defines

#define EAX   0
#define ECX   1
#define EDX   2
#define EBX   3
#define ESP   4
#define EBP   5
#define ESI   6
#define EDI   7
#define AX   0
#define CX   1
#define DX   2
#define BX   3
#define SP   4
#define BP   5
#define SI   6
#define DI   7
#define AL   0
#define CL   1
#define DL   2
#define BL   3
#define MOVid(r32, i32)   emitm(&stream, 11 << 4 | 1 << 3 | r32 & 0x7, 1); emitm(&stream, i32, 4);
 mov r32,i32
#define MOVrd(dr32, sr32)   emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);
 mov dr32,sr32
#define MOVodd(dr32, sr32, off)
 mov dr32,sr32[off]
#define MOVobd(dr32, sr32, or32)
 mov dr32,sr32[or32]
#define MOVobw(dr32, sr32, or32)
 mov dr16,sr32[or32]
#define MOVobb(dr8, sr32, or32)
 mov dr8,sr32[or32]
#define MOVomd(dr32, or32, sr32)
 mov [dr32][or32],sr32
#define BSWAP(dr32)
 bswap dr32
#define SWAP_AX()
 xchg al,ah
#define PUSH(r32)   emitm(&stream, 5 << 4 | 0 << 3 | r32 & 0x7, 1);
 push r32
#define POP(r32)   emitm(&stream, 5 << 4 | 1 << 3 | r32 & 0x7, 1);
 pop r32
#define RET()   emitm(&stream, 12 << 4 | 0 << 3 | 3, 1);
 ret
#define ADDrd(dr32, sr32)
 add dr32,sr32
#define ADD_EAXi(i32)
 add eax,i32
#define ADDid(r32, i32)
 add r32,i32
#define ADDib(r32, i8)
 add r32,i8
#define SUBrd(dr32, sr32)
 sub dr32,sr32
#define SUB_EAXi(i32)
 sub eax,i32
#define MULrd(r32)
 mul r32
#define DIVrd(r32)
 div r32
#define ANDib(r8, i8)
 and r8,i8
#define ANDid(r32, i32)
 and r32,i32
#define ANDrd(dr32, sr32)
 and dr32,sr32
#define ORrd(dr32, sr32)
 or dr32,sr32
#define ORid(r32, i32)
 or r32,i32
#define SHLib(r32, i8)
 shl r32,i8
#define SHL_CLrb(dr32)
 shl dr32,cl
#define SHRib(r32, i8)
 shr r32,i8
#define SHR_CLrb(dr32)
 shr dr32,cl
#define NEGd(r32)
 neg r32
#define CMPodd(dr32, sr32, off)
 cmp dr32,sr32[off]
#define CMPrd(dr32, sr32)
 cmp dr32,sr32
#define CMPid(dr32, i32)
 cmp dr32,i32
#define JNEb(off8)
 jne off32
#define JE(off32)
 je off32
#define JLE(off32)
 jle off32
#define JLEb(off8)
 jle off8
#define JA(off32)
 ja off32
#define JAE(off32)
 jae off32
#define JG(off32)
 jg off32
#define JGE(off32)
 jge off32
#define JMP(off32)
 jmp off32

Typedefs

typedef UINT(__cdecl * BPF_filter_function )(PVOID *, ULONG, UINT)
 Prototype of a filtering function created by the jitter.
typedef void(* emit_func )(binary_stream *stream, ULONG value, UINT n)
 Prototype of the emit functions.

Define Documentation

#define ADD_EAXi ( i32   ) 
Value:
emitm(&stream, 0x05, 1);\
  emitm(&stream, i32, 4);

add eax,i32

Definition at line 175 of file jitter.h.

#define ADDib ( r32,
i8   ) 
Value:
emitm(&stream, 0x83, 1);\
  emitm(&stream, 24 << 3 | r32, 1);\
  emitm(&stream, i8, 1);

add r32,i8

Definition at line 186 of file jitter.h.

#define ADDid ( r32,
i32   ) 
Value:
emitm(&stream, 0x81, 1);\
  emitm(&stream, 24 << 3 | r32, 1);\
  emitm(&stream, i32, 4);

add r32,i32

Definition at line 180 of file jitter.h.

#define ADDrd ( dr32,
sr32   ) 
Value:
emitm(&stream, 0x03, 1);\
  emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | (sr32 & 0x7), 1);

add dr32,sr32

Definition at line 170 of file jitter.h.

#define AL   0

Definition at line 63 of file jitter.h.

#define ANDib ( r8,
i8   ) 
Value:
emitm(&stream, 0x80, 1);\
  emitm(&stream, 7 << 5 | r8, 1);\
  emitm(&stream, i8, 1);

and r8,i8

Definition at line 212 of file jitter.h.

#define ANDid ( r32,
i32   ) 
Value:
if (r32 == EAX){ \
  emitm(&stream, 0x25, 1);\
  emitm(&stream, i32, 4);}\
  else{ \
  emitm(&stream, 0x81, 1);\
  emitm(&stream, 7 << 5 | r32, 1);\
  emitm(&stream, i32, 4);}

and r32,i32

Definition at line 218 of file jitter.h.

#define ANDrd ( dr32,
sr32   ) 
Value:
emitm(&stream, 0x23, 1);\
  emitm(&stream,  3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);

and dr32,sr32

Definition at line 228 of file jitter.h.

#define AX   0

Definition at line 54 of file jitter.h.

#define BL   3

Definition at line 66 of file jitter.h.

#define BP   5

Definition at line 59 of file jitter.h.

#define BSWAP ( dr32   ) 
Value:
emitm(&stream, 0xf, 1); \
  emitm(&stream,  0x19 << 3 | dr32 , 1);

bswap dr32

Definition at line 148 of file jitter.h.

#define BX   3

Definition at line 57 of file jitter.h.

#define CL   1

Definition at line 64 of file jitter.h.

#define CMPid ( dr32,
i32   ) 
Value:
if (dr32 == EAX){ \
  emitm(&stream, 0x3d, 1); \
  emitm(&stream,  i32, 4);} \
  else{ \
  emitm(&stream, 0x81, 1); \
  emitm(&stream,  0x1f << 3 | (dr32 & 0x7), 1);\
  emitm(&stream,  i32, 4);}

cmp dr32,i32

Definition at line 286 of file jitter.h.

#define CMPodd ( dr32,
sr32,
off   ) 
Value:
emitm(&stream, 3 << 4 | 3 | 1 << 3, 1); \
  emitm(&stream,  1 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);\
  emitm(&stream,  off, 1);

cmp dr32,sr32[off]

Definition at line 275 of file jitter.h.

#define CMPrd ( dr32,
sr32   ) 
Value:
emitm(&stream, 0x3b, 1); \
  emitm(&stream,  3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);

cmp dr32,sr32

Definition at line 281 of file jitter.h.

#define CX   1

Definition at line 55 of file jitter.h.

#define DI   7

Definition at line 61 of file jitter.h.

#define DIVrd ( r32   ) 
Value:
emitm(&stream, 0xf7, 1);\
  emitm(&stream, 15 << 4 | (r32 & 0x7), 1);

div r32

Definition at line 207 of file jitter.h.

#define DL   2

Definition at line 65 of file jitter.h.

#define DX   2

Definition at line 56 of file jitter.h.

#define EAX   0

Definition at line 45 of file jitter.h.

#define EBP   5

Definition at line 50 of file jitter.h.

#define EBX   3

Definition at line 48 of file jitter.h.

#define ECX   1

Definition at line 46 of file jitter.h.

#define EDI   7

Definition at line 52 of file jitter.h.

#define EDX   2

Definition at line 47 of file jitter.h.

#define ESI   6

Definition at line 51 of file jitter.h.

#define ESP   4

Definition at line 49 of file jitter.h.

#define JA ( off32   ) 
Value:
emitm(&stream, 0x0f, 1);\
   emitm(&stream, 0x87, 1);\
   emitm(&stream, off32, 4);

ja off32

Definition at line 318 of file jitter.h.

#define JAE ( off32   ) 
Value:
emitm(&stream, 0x0f, 1);\
   emitm(&stream, 0x83, 1);\
   emitm(&stream, off32, 4);

jae off32

Definition at line 324 of file jitter.h.

#define JE ( off32   ) 
Value:
emitm(&stream, 0x0f, 1);\
   emitm(&stream, 0x84, 1);\
   emitm(&stream, off32, 4);

je off32

Definition at line 301 of file jitter.h.

#define JG ( off32   ) 
Value:
emitm(&stream, 0x0f, 1);\
   emitm(&stream, 0x8f, 1);\
   emitm(&stream, off32, 4);

jg off32

Definition at line 330 of file jitter.h.

#define JGE ( off32   ) 
Value:
emitm(&stream, 0x0f, 1);\
   emitm(&stream, 0x8d, 1);\
   emitm(&stream, off32, 4);

jge off32

Definition at line 336 of file jitter.h.

#define JLE ( off32   ) 
Value:
emitm(&stream, 0x0f, 1);\
   emitm(&stream, 0x8e, 1);\
   emitm(&stream, off32, 4);

jle off32

Definition at line 307 of file jitter.h.

#define JLEb ( off8   ) 
Value:
emitm(&stream, 0x7e, 1);\
   emitm(&stream, off8, 1);

jle off8

Definition at line 313 of file jitter.h.

#define JMP ( off32   ) 
Value:
emitm(&stream, 0xe9, 1);\
   emitm(&stream, off32, 4);

jmp off32

Definition at line 342 of file jitter.h.

#define JNEb ( off8   ) 
Value:
emitm(&stream, 0x75, 1);\
   emitm(&stream, off8, 1);

jne off32

Definition at line 296 of file jitter.h.

#define MOVid ( r32,
i32   )     emitm(&stream, 11 << 4 | 1 << 3 | r32 & 0x7, 1); emitm(&stream, i32, 4);

mov r32,i32

Definition at line 109 of file jitter.h.

#define MOVobb ( dr8,
sr32,
or32   ) 
Value:
emitm(&stream, 0x8a, 1); \
  emitm(&stream,  (dr8 & 0x7) << 3 | 4 , 1);\
  emitm(&stream,  (or32 & 0x7) << 3 | (sr32 & 0x7) , 1);

mov dr8,sr32[or32]

Definition at line 136 of file jitter.h.

#define MOVobd ( dr32,
sr32,
or32   ) 
Value:
emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \
  emitm(&stream,  (dr32 & 0x7) << 3 | 4 , 1);\
  emitm(&stream,  (or32 & 0x7) << 3 | (sr32 & 0x7) , 1);

mov dr32,sr32[or32]

Definition at line 123 of file jitter.h.

#define MOVobw ( dr32,
sr32,
or32   ) 
Value:
emitm(&stream, 0x66, 1); \
  emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \
  emitm(&stream,  (dr32 & 0x7) << 3 | 4 , 1);\
  emitm(&stream,  (or32 & 0x7) << 3 | (sr32 & 0x7) , 1);

mov dr16,sr32[or32]

Definition at line 129 of file jitter.h.

#define MOVodd ( dr32,
sr32,
off   ) 
Value:
emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \
  emitm(&stream,  1 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);\
  emitm(&stream,  off, 1);

mov dr32,sr32[off]

Definition at line 117 of file jitter.h.

#define MOVomd ( dr32,
or32,
sr32   ) 
Value:
emitm(&stream, 0x89, 1); \
  emitm(&stream,  (sr32 & 0x7) << 3 | 4 , 1);\
  emitm(&stream,  (or32 & 0x7) << 3 | (dr32 & 0x7) , 1);

mov [dr32][or32],sr32

Definition at line 142 of file jitter.h.

#define MOVrd ( dr32,
sr32   )     emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);

mov dr32,sr32

Definition at line 113 of file jitter.h.

#define MULrd ( r32   ) 
Value:
emitm(&stream, 0xf7, 1);\
  emitm(&stream, 7 << 5 | (r32 & 0x7), 1);

mul r32

Definition at line 202 of file jitter.h.

#define NEGd ( r32   ) 
Value:
emitm(&stream, 0xf7, 1);\
  emitm(&stream,  27 << 3 | r32 & 0x7, 1);

neg r32

Definition at line 270 of file jitter.h.

#define ORid ( r32,
i32   ) 
Value:
if (r32 == EAX){ \
  emitm(&stream, 0x0d, 1);\
  emitm(&stream, i32, 4);}\
  else{ \
  emitm(&stream, 0x81, 1);\
  emitm(&stream, 25 << 3 | r32, 1);\
  emitm(&stream, i32, 4);}

or r32,i32

Definition at line 238 of file jitter.h.

#define ORrd ( dr32,
sr32   ) 
Value:
emitm(&stream, 0x0b, 1);\
  emitm(&stream,  3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);

or dr32,sr32

Definition at line 233 of file jitter.h.

#define POP ( r32   )     emitm(&stream, 5 << 4 | 1 << 3 | r32 & 0x7, 1);

pop r32

Definition at line 162 of file jitter.h.

#define PUSH ( r32   )     emitm(&stream, 5 << 4 | 0 << 3 | r32 & 0x7, 1);

push r32

Definition at line 158 of file jitter.h.

 
#define RET (  )     emitm(&stream, 12 << 4 | 0 << 3 | 3, 1);

ret

Definition at line 166 of file jitter.h.

#define SHL_CLrb ( dr32   ) 
Value:
emitm(&stream, 0xd3, 1);\
  emitm(&stream,  7 << 5 | dr32 & 0x7, 1);

shl dr32,cl

Definition at line 254 of file jitter.h.

#define SHLib ( r32,
i8   ) 
Value:
emitm(&stream, 0xc1, 1);\
  emitm(&stream, 7 << 5 | r32 & 0x7, 1);\
  emitm(&stream, i8, 1);

shl r32,i8

Definition at line 248 of file jitter.h.

#define SHR_CLrb ( dr32   ) 
Value:
emitm(&stream, 0xd3, 1);\
  emitm(&stream,  29 << 3 | dr32 & 0x7, 1);

shr dr32,cl

Definition at line 265 of file jitter.h.

#define SHRib ( r32,
i8   ) 
Value:
emitm(&stream, 0xc1, 1);\
  emitm(&stream, 29 << 3 | r32 & 0x7, 1);\
  emitm(&stream, i8, 1);

shr r32,i8

Definition at line 259 of file jitter.h.

#define SI   6

Definition at line 60 of file jitter.h.

#define SP   4

Definition at line 58 of file jitter.h.

#define SUB_EAXi ( i32   ) 
Value:
emitm(&stream, 0x2d, 1);\
  emitm(&stream, i32, 4);

sub eax,i32

Definition at line 197 of file jitter.h.

#define SUBrd ( dr32,
sr32   ) 
Value:
emitm(&stream, 0x2b, 1);\
  emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | (sr32 & 0x7), 1);

sub dr32,sr32

Definition at line 192 of file jitter.h.

 
#define SWAP_AX (  ) 
Value:
emitm(&stream, 0x86, 1); \
  emitm(&stream,  0xc4 , 1);

xchg al,ah

Definition at line 153 of file jitter.h.

Typedef Documentation

typedef UINT(__cdecl * BPF_filter_function)(PVOID *, ULONG, UINT)

Prototype of a filtering function created by the jitter.

The syntax and the meaning of the parameters is analogous to the one of bpf_filter(). Notice that the filter is not among the parameters, because it is hardwired in the function.

Definition at line 82 of file jitter.h.

typedef void(* emit_func)(binary_stream *stream, ULONG value, UINT n)

Prototype of the emit functions.

Different emit functions are used to create the reference table and to generate the actual filtering code. This allows to have simpler instruction macros. The first parameter is the stream that will receive the data. The secon one is a variable containing the data, the third one is the length, that can be 1,2 or 4 since it is possible to emit a byte, a short or a work at a time.

Definition at line 92 of file jitter.h.

documentation. Copyright (c) 2002-2005 Politecnico di Torino. Copyright (c) 2005-2009 CACE Technologies. All rights reserved.