3

I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not one of the operands for this instruction. As an example, let's take rlc instruction:

rlc A

It basically rotates A left with Carry (C). C is part of STATUS register (just one bit). I cannot modify anything within the ev_ana_insn callback as per IDA Pro documentation, so it looks like that:

def ev_ana_insn(self, insn):
    if b == 0x67:  # rlc
        insn.size = 1
        insn.itype = self.itype_rlc
        insn.Op1.type = ida_ua.o_reg
        insn.Op1.reg = self.ireg_A

That's fine. But in ev_emu_insn I don't understand how and where should I modify the STATUS register, since it is missing (and shouldn't be there in the first place) from insn.

I had a couple of thoughts, but they are not good enough in my opinion:

  1. Use auxprefs in insn or specvals in Op1 and save the information about needed changes to the STATUS register. But still, I need to make these changes and track them somewhere during the analysis and emulation stages.
  2. Map the STATUS register to RAM segment and modify it there. Here as example of such an implementation: https://github.com/Treeki/TM155-tools/blob/master/ida-module/ht68fb560.py#L470, but I don't know if it's the correct approach.
  3. Put another Op2 in my insn, assign it to the STATUS register and modify it during the emulation stage. However, this approach breaks the whole disassembler, since it expects 2 operands, but really there is only 1. I can play around with that during the output stage, but I don't think that it is a correct approach and is more like a hack.

So, any input is much appreciated.

5
  • Do you actually need to do that? What negative effects are you experiencing by not modelling the changes to the STATUS register? This is common on other processors also, such as adc and sbb on x86, and I think the dependency and modifications to eflags are simply not modelled. Mar 10 at 22:16
  • Actually, I do. Some instructions with completely the same opcode have different mode of operation on operands (byte or word) based on flag in STATUS register. So, by not tracking this flag I don't know which instruction to display.
    – none32
    Mar 11 at 11:07
  • Is it possible to track the value of the STATUS register statically? Suppose A is loaded with the result of calling a random number generator before invoking some instruction that modifies the STATUS register based upon the contents of A. How would you model the update to the STATUS register? Mar 11 at 19:36
  • Result of A is irrelevant. The only thing that could modify the STATUS register is a set of specific instructions, independent of the operand(s) contents. Also, it is being initialized during the RESET event to the predefined value. Therefore, it could be statically tracked.
    – none32
    Mar 11 at 19:40
  • Suppose every possible instruction that could modify the STATUS register was in a switch statement, whose switch expression was the result of calling a randon number generator. How would you track the value of the STATUS register? (I realize this is probably not what's happening in your binary, but the questions are intended to be Socratic.) Mar 11 at 19:43

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.