1use crate::{
8 AmodeOffset, AmodeOffsetPlusKnownOffset, AsReg, CodeSink, Constant, Fixed, Gpr, Inst, Label,
9 NonRspGpr, Registers, TrapCode, Xmm,
10};
11use arbitrary::{Arbitrary, Result, Unstructured};
12use capstone::{Capstone, arch::BuildsCapstone, arch::BuildsCapstoneSyntax, arch::x86};
13
14pub fn roundtrip(inst: &Inst<FuzzRegs>) {
23 let assembled = assemble(inst);
25 let expected = disassemble(&assembled, inst);
26
27 let expected = expected.split_once(' ').unwrap().1;
30 let actual = inst.to_string();
31 if expected != actual && expected.trim() != fix_up(&actual) {
32 println!("> {inst}");
33 println!(" debug: {inst:x?}");
34 println!(" assembled: {}", pretty_print_hexadecimal(&assembled));
35 println!(" expected (capstone): {expected}");
36 println!(" actual (to_string): {actual}");
37 assert_eq!(expected, &actual);
38 }
39}
40
41fn assemble(inst: &Inst<FuzzRegs>) -> Vec<u8> {
46 let mut sink = TestCodeSink::default();
47 let offsets: Vec<i32> = Vec::new();
48 inst.encode(&mut sink, &offsets);
49 sink.patch_labels_as_if_they_referred_to_end();
50 sink.buf
51}
52
53#[derive(Default)]
54struct TestCodeSink {
55 buf: Vec<u8>,
56 offsets_using_label: Vec<u32>,
57}
58
59impl TestCodeSink {
60 fn patch_labels_as_if_they_referred_to_end(&mut self) {
75 let len = i32::try_from(self.buf.len()).unwrap();
76 for offset in self.offsets_using_label.iter() {
77 let range = self.buf[*offset as usize..].first_chunk_mut::<4>().unwrap();
78 let offset = i32::try_from(*offset).unwrap() + 4;
79 let rel_distance = len - offset;
80 *range = (i32::from_le_bytes(*range) + rel_distance).to_le_bytes();
81 }
82 }
83}
84
85impl CodeSink for TestCodeSink {
86 fn put1(&mut self, v: u8) {
87 self.buf.extend_from_slice(&[v]);
88 }
89
90 fn put2(&mut self, v: u16) {
91 self.buf.extend_from_slice(&v.to_le_bytes());
92 }
93
94 fn put4(&mut self, v: u32) {
95 self.buf.extend_from_slice(&v.to_le_bytes());
96 }
97
98 fn put8(&mut self, v: u64) {
99 self.buf.extend_from_slice(&v.to_le_bytes());
100 }
101
102 fn add_trap(&mut self, _: TrapCode) {}
103
104 fn current_offset(&self) -> u32 {
105 self.buf.len().try_into().unwrap()
106 }
107
108 fn use_label_at_offset(&mut self, offset: u32, _: Label) {
109 self.offsets_using_label.push(offset);
110 }
111
112 fn get_label_for_constant(&mut self, c: Constant) -> Label {
113 Label(c.0)
114 }
115}
116
117fn disassemble(assembled: &[u8], original: &Inst<FuzzRegs>) -> String {
119 let cs = Capstone::new()
120 .x86()
121 .mode(x86::ArchMode::Mode64)
122 .syntax(x86::ArchSyntax::Att)
123 .detail(true)
124 .build()
125 .expect("failed to create Capstone object");
126 let insts = cs
127 .disasm_all(assembled, 0x0)
128 .expect("failed to disassemble");
129
130 if insts.len() != 1 {
131 println!("> {original}");
132 println!(" debug: {original:x?}");
133 println!(" assembled: {}", pretty_print_hexadecimal(&assembled));
134 assert_eq!(insts.len(), 1, "not a single instruction");
135 }
136
137 let inst = insts.first().expect("at least one instruction");
138 if assembled.len() != inst.len() {
139 println!("> {original}");
140 println!(" debug: {original:x?}");
141 println!(" assembled: {}", pretty_print_hexadecimal(&assembled));
142 println!(
143 " capstone-assembled: {}",
144 pretty_print_hexadecimal(inst.bytes())
145 );
146 assert_eq!(assembled.len(), inst.len(), "extra bytes not disassembled");
147 }
148
149 inst.to_string()
150}
151
152fn pretty_print_hexadecimal(hex: &[u8]) -> String {
153 use std::fmt::Write;
154 let mut s = String::with_capacity(hex.len() * 2);
155 for b in hex {
156 write!(&mut s, "{b:02X}").unwrap();
157 }
158 s
159}
160
161macro_rules! hex_print_signed_imm {
163 ($hex:expr, $from:ty => $to:ty) => {{
164 let imm = <$from>::from_str_radix($hex, 16).unwrap() as $to;
165 let mut simm = String::new();
166 if imm < 0 {
167 simm.push_str("-");
168 }
169 let abs = match imm.checked_abs() {
170 Some(i) => i,
171 None => <$to>::MIN,
172 };
173 if imm > -10 && imm < 10 {
174 simm.push_str(&format!("{:x}", abs));
175 } else {
176 simm.push_str(&format!("0x{:x}", abs));
177 }
178 simm
179 }};
180}
181
182fn replace_signed_immediates(dis: &str) -> std::borrow::Cow<str> {
191 match dis.find('$') {
192 None => dis.into(),
193 Some(idx) => {
194 let (prefix, rest) = dis.split_at(idx + 1); let (_, rest) = chomp("-", rest); let (_, rest) = chomp("0x", rest); let n = rest.chars().take_while(char::is_ascii_hexdigit).count();
198 let (hex, rest) = rest.split_at(n); let simm = if dis.starts_with("mov") {
200 u64::from_str_radix(hex, 16).unwrap().to_string()
201 } else {
202 match hex.len() {
203 1 | 2 => hex_print_signed_imm!(hex, u8 => i8),
204 4 => hex_print_signed_imm!(hex, u16 => i16),
205 8 => hex_print_signed_imm!(hex, u32 => i32),
206 16 => hex_print_signed_imm!(hex, u64 => i64),
207 _ => panic!("unexpected length for hex: {hex}"),
208 }
209 };
210 format!("{prefix}{simm}{rest}").into()
211 }
212 }
213}
214
215fn chomp<'a>(pat: &str, s: &'a str) -> (&'a str, &'a str) {
217 if s.starts_with(pat) {
218 s.split_at(pat.len())
219 } else {
220 ("", s)
221 }
222}
223
224#[test]
225fn replace() {
226 assert_eq!(
227 replace_signed_immediates("andl $0xffffff9a, %r11d"),
228 "andl $-0x66, %r11d"
229 );
230 assert_eq!(
231 replace_signed_immediates("xorq $0xffffffffffffffbc, 0x7f139ecc(%r9)"),
232 "xorq $-0x44, 0x7f139ecc(%r9)"
233 );
234 assert_eq!(
235 replace_signed_immediates("subl $0x3ca77a19, -0x1a030f40(%r14)"),
236 "subl $0x3ca77a19, -0x1a030f40(%r14)"
237 );
238 assert_eq!(
239 replace_signed_immediates("movq $0xffffffff864ae103, %rsi"),
240 "movq $18446744071667638531, %rsi"
241 );
242}
243
244fn remove_after_semicolon(dis: &str) -> &str {
248 match dis.find(';') {
249 None => dis,
250 Some(idx) => {
251 let (prefix, _) = dis.split_at(idx);
252 prefix.trim()
253 }
254 }
255}
256
257#[test]
258fn remove_after_parenthesis_test() {
259 assert_eq!(
260 remove_after_semicolon("imulb 0x7658eddd(%rcx) ;; implicit: %ax"),
261 "imulb 0x7658eddd(%rcx)"
262 );
263}
264
265fn fix_up(dis: &str) -> std::borrow::Cow<str> {
267 let dis = remove_after_semicolon(dis);
268 replace_signed_immediates(&dis)
269}
270
271#[derive(Arbitrary, Debug)]
275pub struct FuzzRegs;
276
277impl Registers for FuzzRegs {
278 type ReadGpr = FuzzReg;
279 type ReadWriteGpr = FuzzReg;
280 type WriteGpr = FuzzReg;
281 type ReadXmm = FuzzReg;
282 type ReadWriteXmm = FuzzReg;
283 type WriteXmm = FuzzReg;
284}
285
286#[derive(Clone, Copy, Debug, PartialEq)]
288pub struct FuzzReg(u8);
289
290impl<'a> Arbitrary<'a> for FuzzReg {
291 fn arbitrary(u: &mut arbitrary::Unstructured<'a>) -> arbitrary::Result<Self> {
292 Ok(Self(u.int_in_range(0..=15)?))
293 }
294}
295
296impl AsReg for FuzzReg {
297 fn new(enc: u8) -> Self {
298 Self(enc)
299 }
300 fn enc(&self) -> u8 {
301 self.0
302 }
303}
304
305impl Arbitrary<'_> for AmodeOffsetPlusKnownOffset {
306 fn arbitrary(u: &mut Unstructured<'_>) -> Result<Self> {
307 Ok(Self {
309 simm32: AmodeOffset::arbitrary(u)?,
310 offset: None,
311 })
312 }
313}
314
315impl<R: AsReg, const E: u8> Arbitrary<'_> for Fixed<R, E> {
316 fn arbitrary(_: &mut Unstructured<'_>) -> Result<Self> {
317 Ok(Self::new(E))
318 }
319}
320
321impl<R: AsReg> Arbitrary<'_> for NonRspGpr<R> {
322 fn arbitrary(u: &mut Unstructured<'_>) -> Result<Self> {
323 use crate::gpr::enc::*;
324 let gpr = u.choose(&[
325 RAX, RCX, RDX, RBX, RBP, RSI, RDI, R8, R9, R10, R11, R12, R13, R14, R15,
326 ])?;
327 Ok(Self::new(R::new(*gpr)))
328 }
329}
330impl<'a, R: AsReg> Arbitrary<'a> for Gpr<R> {
331 fn arbitrary(u: &mut Unstructured<'a>) -> Result<Self> {
332 Ok(Self(R::new(u.int_in_range(0..=15)?)))
333 }
334}
335impl<'a, R: AsReg> Arbitrary<'a> for Xmm<R> {
336 fn arbitrary(u: &mut Unstructured<'a>) -> Result<Self> {
337 Ok(Self(R::new(u.int_in_range(0..=15)?)))
338 }
339}
340
341pub trait RegistersArbitrary:
344 Registers<
345 ReadGpr: for<'a> Arbitrary<'a>,
346 ReadWriteGpr: for<'a> Arbitrary<'a>,
347 WriteGpr: for<'a> Arbitrary<'a>,
348 ReadXmm: for<'a> Arbitrary<'a>,
349 ReadWriteXmm: for<'a> Arbitrary<'a>,
350 WriteXmm: for<'a> Arbitrary<'a>,
351 >
352{
353}
354
355impl<R> RegistersArbitrary for R
356where
357 R: Registers,
358 R::ReadGpr: for<'a> Arbitrary<'a>,
359 R::ReadWriteGpr: for<'a> Arbitrary<'a>,
360 R::WriteGpr: for<'a> Arbitrary<'a>,
361 R::ReadXmm: for<'a> Arbitrary<'a>,
362 R::ReadWriteXmm: for<'a> Arbitrary<'a>,
363 R::WriteXmm: for<'a> Arbitrary<'a>,
364{
365}
366
367#[cfg(test)]
368mod test {
369 use super::*;
370 use arbtest::arbtest;
371 use std::sync::atomic::{AtomicUsize, Ordering};
372
373 #[test]
374 fn smoke() {
375 let count = AtomicUsize::new(0);
376 arbtest(|u| {
377 let inst: Inst<FuzzRegs> = u.arbitrary()?;
378 roundtrip(&inst);
379 println!("#{}: {inst}", count.fetch_add(1, Ordering::SeqCst));
380 Ok(())
381 })
382 .budget_ms(1_000);
383
384 }
387}