mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2026-10-21 00:56:07 +08:00
emteere
209 lines
6.6 KiB
XML
209 lines
6.6 KiB
XML
<patternlist>
|
|
|
|
<pattern> <!-- .plt entry thunk -->
|
|
<data>
|
|
0x280041f8 <!-- std r2,0x28(r1) -->
|
|
0xff 0xff ...00010 001111.. <!-- subis rX,r2,0x1 -->
|
|
........ ........ ........ 0xe9 <!-- ld rX,#(x) -->
|
|
0xa6 0x03 0x.9 0x7d <!-- mtctr rX -->
|
|
........ ........ 010..... 0xe8 <!-- ld r2,#(x) -->
|
|
0x00002228 <!-- cmpldi r2,0 -->
|
|
0x20 0x04 1..00010 0x4c <!-- bnectr+ -->
|
|
......00 ........ ........ 010010.. <!-- b X@plt -->
|
|
</data>
|
|
<funcstart thunk="true" section="(?i)(\.plt(\.sec)?)"/> <!-- must be something define before this -->
|
|
</pattern>
|
|
|
|
<pattern> <!-- .plt entry thunk -->
|
|
<data>
|
|
0x280041f8 <!-- std r2,0x28(r1) -->
|
|
........ ........ ........ 0xe9 <!-- ld rX,#(x) -->
|
|
0xa6 0x03 0x.9 0x7d <!-- mtctr rX -->
|
|
........ ........ 010..... 0xe8 <!-- ld r2,#(x) -->
|
|
0x00002228 <!-- cmpldi r2,0 -->
|
|
0x20 0x04 1..00010 0x4c <!-- bnectr+ -->
|
|
......00 ........ ........ 010010.. <!-- b X@plt -->
|
|
</data>
|
|
<funcstart thunk="true" section="(?i)(\.plt(\.sec)?)"/> <!-- must be something define before this -->
|
|
</pattern>
|
|
|
|
<pattern> <!-- .plt entry thunk -->
|
|
<data>
|
|
0xa6 0x02 ...01000 011111.. <!-- mfspr rxx, LR -->
|
|
0x05 0x00 1....... 0x42 <!-- bl +0x4 -->
|
|
0xa6 0x02 ...01000 011111.. <!-- mfspr rxx,LR -->
|
|
0x.. 0x.. ........ 001111.. <!-- addis rxx, rxx, 0xxx -->
|
|
0x.. 0x.. ........ 001110.. <!-- addi rxx, rxx, 0xxx -->
|
|
0xa6 0x03 ...01000 011111.. <!-- mtspr LR, rxx -->
|
|
0xa6 0x03 ...01001 011111.. <!-- mtspr CTR, rxx -->
|
|
0x20 0x04 10000... 0x4e <!--bctr -->
|
|
</data>
|
|
<funcstart thunk="true"/>
|
|
</pattern>
|
|
|
|
<!--
|
|
Known call stub (i.e., thunk) patterns which
|
|
utilize a propagated r2 register value in determining the thunked function
|
|
to which any given call stub branches.
|
|
|
|
NOTE: Each pattern must account for all instructions contained within the stub.
|
|
-->
|
|
<pattern>
|
|
<data>
|
|
0x3d82.... # addis r12,r2,0x####
|
|
0xf84100.. # std r2,0x##(r1)
|
|
0xe96c.... # ld r11,0x####(r12)
|
|
0x7d6903a6 # mtspr CTR,r11
|
|
0xe84c.... # ld r2,0x####(r12)
|
|
0xe96c.... # ld r11,0x####(r12)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<funcstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0xf84100.. # std r2,0x##(r1)
|
|
0xe962.... # ld r11,0x####(r2)
|
|
0x7d6903a6 # mtspr CTR,r11
|
|
0xe962.... # ld r11,0x####(r2)
|
|
0xe842.... # ld r2,0x####(r2)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<funcstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0xf84100.. # std r2,0x##(r1)
|
|
0xe982.... # ld r12,0x####(r2)
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<funcstart after="defined" thunk="true"/>
|
|
</pattern>
|
|
<!-- It is possible that the patterns below always appear inline and not used as a thunk -->
|
|
<pattern>
|
|
<data>
|
|
0x3d62.... # addis r11,r2,0x####
|
|
0xe98b.... # ld r12,0x####(r11)
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0xe84b.... # ld r2,0x####(r11)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0x3d62.... # addis r11,r2,0x####
|
|
0xe98b.... # ld r12,0x####(r11)
|
|
0x396b.... # addi r11,r11,0x####
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0xe84b.... # ld r2,0x####(r11)
|
|
0xe96b.... # ld r11,0x####(r11)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0x3d62.... # addis r11,r2,0x####
|
|
0xe98b.... # ld r12,0x####(r11)
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0x7d826278 # xor r2,r12,r12
|
|
0x7d6b1214 # add r11,r11,r2
|
|
0xe84b.... # ld r2,0x####(r11)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0x3d62.... # addis r11,r2,0x####
|
|
0xe98b.... # ld r12,0x####(r11)
|
|
0x396b.... # addi r11,r11,0x####
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0x7d826278 # xor r2,r12,r12
|
|
0x7d6b1214 # add r11,r11,r2
|
|
0xe84b.... # ld r2,0x####(r11)
|
|
0xe96b.... # ld r11,0x####(r11)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0xf84100.. # std r2,0x##(r1)
|
|
0x3d62.... # addis r11,r2,0x####
|
|
0xe98b.... # ld r12,0x####(r11)
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0xe84b.... # ld r2,0x####(r11)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0xf84100.. # std r2,0x##(r1)
|
|
0x3d62.... # addis r11,r2,0x####
|
|
0xe98b.... # ld r12,0x####(r11)
|
|
0x396b.... # addi r11,r11,0x####
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0xe84b.... # ld r2,0x####(r11)
|
|
0xe96b.... # ld r11,0x####(r11)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0xf84100.. # std r2,0x##(r1)
|
|
0x3d62.... # addis r11,r2,0x####
|
|
0xe98b.... # ld r12,0x####(r11)
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0x7d826278 # xor r2,r12,r12
|
|
0x7d6b1214 # add r11,r11,r2
|
|
0xe84b.... # ld r2,0x####(r11)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0xf84100.. # std r2,0x##(r1)
|
|
0x3d62.... # addis r11,r2,0x####
|
|
0xe98b.... # ld r12,0x####(r11)
|
|
0x396b.... # addi r11,r11,0x####
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0x7d826278 # xor r2,r12,r12
|
|
0x7d6b1214 # add r11,r11,r2
|
|
0xe84b.... # ld r2,0x####(r11)
|
|
0xe96b.... # ld r11,0x####(r11)
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
<!--
|
|
The case where call stub performs conditional bnectr followed
|
|
by relative branch is omitted since this is not a valid thunk
|
|
scenario.
|
|
-->
|
|
<pattern>
|
|
<data>
|
|
0x3d820000 # addis r12,r2,0x####
|
|
0xe98c0000 # ld r12,0x####(r12)
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
<pattern>
|
|
<data>
|
|
0xf8410000 # std r2,0x####(r1)
|
|
0x3d820000 # addis r12,r2,0x####
|
|
0xe98c0000 # ld r12,0x####(r12)
|
|
0x7d8903a6 # mtspr CTR,r12
|
|
0x4e800420 # bctr
|
|
</data>
|
|
<possiblefuncstart thunk="true"/>
|
|
</pattern>
|
|
</patternlist>
|