Unlock 30% off on Manual Testing Annual Plans this Holiday Season.

Copied to Clipboard!

How to use mov32toSPaddr method of x86 Package

Best Syzkaller code snippet using x86.mov32toSPaddr

pseudo.go

Source:pseudo.go

...172			gen := makeGen(cfg, r)173			sel := randSelector(r)174			off := iset.GenerateInt(cfg, r, 4)175			if cfg.Mode == iset.ModeLong64 {176				gen.mov32toSPaddr(uint32(sel), 0)177				gen.mov32toSPaddr(uint32(off), 2)178				if r.Intn(2) == 0 {179					gen.byte(0xff, 0x2c, 0x24) // ljmp (%rsp)180				} else {181					gen.byte(0xff, 0x1c, 0x24) // lcall (%rsp)182				}183			} else {184				if r.Intn(2) == 0 {185					gen.byte(0xea) // ljmp $imm16, $imm16/32186				} else {187					gen.byte(0x9a) // lcall $imm16, $imm16/32188				}189				if cfg.Mode == iset.ModeProt16 {190					gen.imm16(uint16(off))191				} else {192					gen.imm32(uint32(off))193				}194				gen.imm16(sel)195			}196			return gen.text197		},198	},199	{200		Name:   "PSEUDO_LTR_LLDT",201		Mode:   1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,202		Priv:   true,203		Pseudo: true,204		generator: func(cfg *iset.Config, r *rand.Rand) []byte {205			gen := makeGen(cfg, r)206			sel := randSelector(r)207			gen.mov16(regAX, sel)208			if r.Intn(2) == 0 {209				gen.byte(0x0f, 0x00, 0xd8) // ltr %ax210			} else {211				gen.byte(0x0f, 0x00, 0xd0) // lldt %ax212			}213			return gen.text214		},215	},216	{217		Name:   "PSEUDO_LGIDT",218		Mode:   1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,219		Priv:   true,220		Pseudo: true,221		generator: func(cfg *iset.Config, r *rand.Rand) []byte {222			gen := makeGen(cfg, r)223			limit := uint32(iset.GenerateInt(cfg, r, 2))224			base := uint32(iset.GenerateInt(cfg, r, 4))225			gen.mov32toSPaddr(limit, 0)226			gen.mov32toSPaddr(base, 2)227			gen.mov32toSPaddr(0, 6)228			gen.addr32()229			if r.Intn(2) == 0 {230				gen.byte(0x0f, 0x01, 0x14, 0x24) // lgdt (%rsp)231			} else {232				gen.byte(0x0f, 0x01, 0x1c, 0x24) // lidt (%rsp)233			}234			return gen.text235		},236	},237	{238		Name:   "PSEUDO_HYPERCALL",239		Mode:   1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,240		Priv:   true,241		Pseudo: true,242		generator: func(cfg *iset.Config, r *rand.Rand) []byte {243			gen := makeGen(cfg, r)244			switch r.Intn(2) {245			case 0:246				gen.mov32(regEAX, 1) // KVM_HC_VAPIC_POLL_IRQ247			case 1:248				gen.mov32(regEAX, 5)                                   // KVM_HC_KICK_CPU249				gen.mov32(regECX, uint32(iset.GenerateInt(cfg, r, 4))) // APIC ID250			default:251				panic("bad")252			}253			if r.Intn(2) == 0 {254				gen.byte(0x0f, 0x01, 0xd9) // vmmcall255			} else {256				gen.byte(0x0f, 0x01, 0xc1) // vmcall257			}258			return gen.text259		},260	},261}262const (263	regAL = iota264	regAX265	regEAX266	regRAX267	regCL268	regCX269	regECX270	regRCX271	regDL272	regDX273	regEDX274	regRDX275)276type generator struct {277	mode iset.Mode278	r    *rand.Rand279	text []byte280}281func makeGen(cfg *iset.Config, r *rand.Rand) *generator {282	return &generator{283		mode: cfg.Mode,284		r:    r,285	}286}287func (gen *generator) byte(v ...uint8) {288	gen.text = append(gen.text, v...)289}290func (gen *generator) imm16(v uint16) {291	gen.byte(byte(v>>0), byte(v>>8))292}293func (gen *generator) imm32(v uint32) {294	gen.byte(byte(v>>0), byte(v>>8), byte(v>>16), byte(v>>24))295}296func (gen *generator) imm64(v uint64) {297	gen.byte(byte(v>>0), byte(v>>8), byte(v>>16), byte(v>>24),298		byte(v>>32), byte(v>>40), byte(v>>48), byte(v>>56))299}300func (gen *generator) operand16() {301	switch gen.mode {302	case iset.ModeLong64, iset.ModeProt32:303		gen.byte(0x66)304	case iset.ModeProt16, iset.ModeReal16:305	default:306		panic("bad mode")307	}308}309func (gen *generator) operand32() {310	switch gen.mode {311	case iset.ModeLong64, iset.ModeProt32:312	case iset.ModeProt16, iset.ModeReal16:313		gen.byte(0x66)314	default:315		panic("bad mode")316	}317}318func (gen *generator) addr32() {319	switch gen.mode {320	case iset.ModeLong64, iset.ModeProt32:321	case iset.ModeProt16, iset.ModeReal16:322		gen.byte(0x67)323	default:324		panic("bad mode")325	}326}327func (gen *generator) mov8(reg int, v uint8) {328	switch reg {329	case regAL:330		gen.byte(0xb0)331	case regCL:332		gen.byte(0xb1)333	case regDL:334		gen.byte(0xb2)335	default:336		panic("unknown register")337	}338	gen.byte(v)339}340func (gen *generator) mov16(reg int, v uint16) {341	gen.operand16()342	switch reg {343	case regAX:344		gen.byte(0xb8)345	case regCX:346		gen.byte(0xb9)347	case regDX:348		gen.byte(0xba)349	default:350		panic("unknown register")351	}352	gen.imm16(v)353}354func (gen *generator) mov32(reg int, v uint32) {355	gen.operand32()356	switch reg {357	case regEAX:358		gen.byte(0xb8)359	case regECX:360		gen.byte(0xb9)361	case regEDX:362		gen.byte(0xba)363	default:364		panic("unknown register")365	}366	gen.imm32(v)367}368func (gen *generator) mov64(reg int, v uint64) {369	if gen.mode != iset.ModeLong64 {370		panic("bad mode")371	}372	gen.byte(0x48)373	switch reg {374	case regRAX:375		gen.byte(0xb8)376	case regRCX:377		gen.byte(0xb9)378	case regRDX:379		gen.byte(0xba)380	default:381		panic("unknown register")382	}383	gen.imm64(v)384}385// movl $v, off(%rsp).386func (gen *generator) mov32toSPaddr(v uint32, off uint8) {387	gen.addr32()388	gen.operand32()389	gen.byte(0xc7, 0x44, 0x24, off)390	gen.imm32(v)391}392func (gen *generator) xor32(reg int, v uint32) {393	gen.operand32()394	switch reg {395	case regEAX:396		gen.byte(0x35)397	default:398		panic("unknown register")399	}400	gen.imm32(v)...

Automation Testing Tutorials

Learn to execute automation testing from scratch with LambdaTest Learning Hub. Right from setting up the prerequisites to run your first automation test, to following best practices and diving deeper into advanced test scenarios. LambdaTest Learning Hubs compile a list of step-by-step guides to help you be proficient with different test automation frameworks i.e. Selenium, Cypress, TestNG etc.