I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not one of the operands for this instruction. As an example, let's take rlc
instruction:
rlc A
It basically rotates A left with Carry (C). C is part of STATUS register (just one bit). I cannot modify anything within the ev_ana_insn
callback as per IDA Pro documentation, so it looks like that:
def ev_ana_insn(self, insn):
if b == 0x67: # rlc
insn.size = 1
insn.itype = self.itype_rlc
insn.Op1.type = ida_ua.o_reg
insn.Op1.reg = self.ireg_A
That's fine. But in ev_emu_insn
I don't understand how and where should I modify the STATUS
register, since it is missing (and shouldn't be there in the first place) from insn
.
I had a couple of thoughts, but they are not good enough in my opinion:
- Use
auxprefs
ininsn
orspecvals
inOp1
and save the information about needed changes to theSTATUS
register. But still, I need to make these changes and track them somewhere during the analysis and emulation stages. - Map the
STATUS
register to RAM segment and modify it there. Here as example of such an implementation: https://github.com/Treeki/TM155-tools/blob/master/ida-module/ht68fb560.py#L470, but I don't know if it's the correct approach. - Put another
Op2
in myinsn
, assign it to theSTATUS
register and modify it during the emulation stage. However, this approach breaks the whole disassembler, since it expects 2 operands, but really there is only 1. I can play around with that during the output stage, but I don't think that it is a correct approach and is more like a hack.
So, any input is much appreciated.
STATUS
register? This is common on other processors also, such asadc
andsbb
on x86, and I think the dependency and modifications toeflags
are simply not modelled.STATUS
register statically? SupposeA
is loaded with the result of calling a random number generator before invoking some instruction that modifies theSTATUS
register based upon the contents ofA
. How would you model the update to theSTATUS
register?STATUS
register was in aswitch
statement, whoseswitch
expression was the result of calling a randon number generator. How would you track the value of theSTATUS
register? (I realize this is probably not what's happening in your binary, but the questions are intended to be Socratic.)