Last year, our team faced the need to analyze the V8 bytecode. At that time, there were no ready-made tools that could restore such code and provide convenient navigation through it. It was decided to try to write a processor module for the Ghidra framework. Due to the peculiarities of the used instruction description language, we got not only a readable set of instructions at the output, but also a C-like decompiler. This article is a continuation of a series of materials ( 1 , 2 ) about our plugin for Ghidra.
Several months passed between the writing of the processor module and the article. During this time, the SLEIGH specification has not changed, and the described module works on versions 9.1.2–9.2.2, which were released over the last six months.
Now on ghidra.re and in the documentation attached to Ghidra there is a fairly good description of the capabilities of the language - these materials are worth reading before writing your own modules. The ready-made processor modules of the framework developers can be excellent examples, especially if you know the architecture described in them.
In the documentation, you can read that processor modules for Ghidra are written in the SLEIGH language, which originated from the SLED (Specification Language for Encoding and Decoding) language and was developed purposefully for Ghidra. It translates machine code into p-code (an intermediate language used by Ghidra to build decompiled code). As a language intended for describing processor instructions, it has a lot of limitations, which, however, can be stopped due to the p-code injection mechanism in java code.
github. , SLEIGH . , p-code, . The Ghidra Book: The Definitive Guide.
Eclipse, , Ghidra: GhidraDev GhidraSleighEditor. Ghidra Module Project v8_bytecode. , .
, , The Ghidra Book: The Definitive Guide. .
*.spec — .
*.ldefs — . . *.sla, .
*.pspec — .
*.opinion — ; , opinion : .
*.slaspec, *.sinc — , SLEIGH.
.sla, slaspec-.
, , , , . . .
V8
Jsc-, , c JavaScript Node.Js 8.16.0 bytenode ( Node.Js, npm). , bytenode Node.js . , jsc js:
Node.js , . , ( bytecode-register.cc, bytecode-register.h). v8 Node.js:
, aX , . .
— <this>, aX — , , rN — , . 1- , 2- Wide- 4- ExtraWide-. Wide- :
, SLEIGH , . , 124 rN 125 aX. , . :
, Node.js - . (X aX) . , , .
, , .
CSPEC
, cspec-, github. :
Ghidra . — , , . Ghidra SLEIGH , Intel x86, . , , . , , .
, :
Compiler Specific P-code Interpretation;
Compiler Datatype Organization ( <data_organization>);
Compiler Scoping and Memory Access ( <global>);
Compiler Special Purpose Registers ( <stackpointer>);
Parameter Passing ( <default_proto>).
, , .
<data_organization> <stackpointer> ; <prototype> <default_proto>, . : <input>
, <output>
, <unaffected>
.
, aX. . , register. . , , , , . (space="register"
) <input>
, , 0x14000 (0x14000 , , *.slaspec aX).
(acc), <output>
. , , . <unaffected>
, , , .
, <global>
register 0x2000.
LDEFS
— .ldefs. : ( le), (*.sla, *.pspec,*.cspec), id , Ghidra. - , Node.js, , <language>, *.ldefs , Ghidra.
, , .
PSPEC
( .pspec). processor_spec.rxg ( Ghidra ). - . , .
, ( <processor_spec> ).
SLASPEC
SLEIGH .slaspec.
. , , .
, ( register ram), define space, — define register. offset , , . size. , *.cspec , .
(https://ghidra.re/courses/languages/html/sleigh_constructors.html) , , — . SLEIGH , , , « ». 5 .
Table Header ( )
Display Section ( )
Bit Pattern Sections ( )
Disassembly Actions Section ( )
Semantics Actions Section ( )
, .
Table Header , , ( ).
Display Section — , Ghidra.
Bit Pattern Section — - , «» c ( ).
Disassembly Actions Section - , .
Semantics Actions Section , , .
( instruction), , .
, , . , , . . , ( ), .
, :
^ — / , ;
“” — , , ;
, ;
( - , , #, ).
. , . , . . , :
tokenMaxSize 8. , - . , , , . : start- endBitNumX 0 tokenMaxSize-1 startBitNumX <= endBitNumX.
v8 , . , , «&» «|».
: , , , «» , .
, . , . v8, ( Wide- ExtraWide- , , ). :
, op , Illegal Nop, :
«0xa7» Ghidra Illegal, . unimpl. , , . Nop , , . Nop Node.js , SwitchOnSmiNoFeedback, .
: LdaSmi, (acc ), AddSmi, c .
bytecodes.h Node.js, operand, . , (. AddSmi).
- LdaSmi [-02]. , , disassembly action ( , ).
AddSmi , op, , «;» operand. . , . , , (, , ).
«;» , , , ( ), .
PCode « » Ghidra. - , p-code.
v8 , lda, . acc . , acc, , .
return, , , :
, , . Mul, , .
« » , , , «» . kReg 8 . attach variables 0b 11111111b ( kReg) . , , , 0xfb (11111011b), kReg r0.
, kReg , :
interpreter-generator.cc Node.js. kReg , Table Header src. — export. p-code, export , «» src. Ghidra .
, :
goto
. SLEIGH goto. , kUImm, . disassembly action rel. inst_start SLEIGH .
SLEIGH . , ( ), , ( , p-code ), .
«» dest. *[ram]:4 rel , 4 rel. rel ram. «*» SLEIGH , ( Dynamic References).
[ram] ( ), . p-code, ram.
JumpIfFalse - . SLEIGH goto. js False , , pspec , , . , .
inst_start . TestGreaterThan, goto (<true> ) inst_next. : , , . .
. .
, (. ), . v8, . , 4 CallProperty2 , . :CallProperty2 kReg, kReg, kReg, kReg, [kIdx] Sleigh . - :
, , . , callable, receiver, arg1 arg2 - attach :
kReg . — .
CallProperty2 , call [callable];, . v8 aX ( cspec). , , (, , sinc-, x86). , . Ghidra, . , - , . :
( : sp , ) CallUndefinedReceiver1:
, , java-. , , , SLEIGH. p-code .
, , . , acc , , . , , ( CallVariadicCallOther « » ). define pcodeop OperationName , .
p-code- : callotherfixup
cspec- .
java- , :
. bytenode jsc- js:
jsc- Ghidra. - , Ghidra , eclipse , . : sleigh .
, . 010. D F, . :
( SLEIGH), . , ( SLEIGH cpool) LdaGlobal. ( ):
, , JavaScript, , .slaspec ( .sinc). , p-code, , p-code. p-code .
v8 , / . . , , .
, , : ForInPrepare r9, r10!3. , , , , , .
,
. . , ARM: ( , - ).
, . , . . , , , , .
, CallProperty , «» , , . , : rangeSrc rangeDst. rangeSrc — , , rangeDst «» . rangeDst , : aX rX .
. «=», , disassembly action. - . , , , aX, rX, . : , , , .
. . , (contextreg ).
, , ( ), . counter offStart , .
, .
, , , - disassembly action. rangeSrc, , disassembly action offStart, — counter. «{».
, v8 range_size: , . rangeSrc .
rangeDst 5 .
a0 counter 0 ( ).
r0 counter 0 ( ).
offStart a0, disassembly action counter , offStart , rangedst1.
offStart r0, disassembly action counter offStart , rangedst1.
, rangedst1( , , , ).
. rangeDstN, N — , , aN/rN.
. rangeSrc , , rangeDst - , . epsilon, .
rangeDst, rangeDst1, rangeDst2, . , github. , rangeDst rangeDstX, , — , .
, . «&» «|».
CallProperty :
:
, , CallVariadicCallOther. github java- p-code. p-code call ( Node.js, , — ). slaspec, , , :
, :
rangeDst ( r7 ) , console.log(1,2,3,4,5,6). bytenode . 0x167, — 0x18b.
, , , , - ( , , , ).
, rangeDst , ( , 2 4 ):
, : , . , , . , , , . , , . , SLEIGH.
Node.js , , .
:
:
https://ghidra.re/courses/languages/html/sleigh.html — SLEIGH.
https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Framework/SoftwareModeling/data/languages — *.cspec, *.pspec, *.opinion, *.ldefs.
https://spinsel.dev/2020/06/17/ghidra-brainfuck-processor-1.html — brainfuck Ghidra.
https://github.com/PositiveTechnologies/ghidra_nodejs — Ghidra .