Skip to content

Commit b4b3e32

Browse files
mrexodiamrexodia
committed
Port AVX512 support from TitanEngine
x64dbg/TitanEngine#22
1 parent 37b6606 commit b4b3e32

File tree

11 files changed

+293
-32
lines changed

11 files changed

+293
-32
lines changed

‎GleeBug/GleeBug.vcxproj

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,31 +21,32 @@
2121
<PropertyGroup Label="Globals">
2222
<ProjectGuid>{B65A3680-9B6B-44E6-A046-649F94DF9F56}</ProjectGuid>
2323
<RootNamespace>GleeBug</RootNamespace>
24+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
2425
</PropertyGroup>
2526
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2627
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
2728
<ConfigurationType>StaticLibrary</ConfigurationType>
2829
<UseDebugLibraries>true</UseDebugLibraries>
29-
<PlatformToolset>v140_xp</PlatformToolset>
30+
<PlatformToolset>v141_xp</PlatformToolset>
3031
<CharacterSet>MultiByte</CharacterSet>
3132
</PropertyGroup>
3233
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
3334
<ConfigurationType>StaticLibrary</ConfigurationType>
3435
<UseDebugLibraries>true</UseDebugLibraries>
35-
<PlatformToolset>v140_xp</PlatformToolset>
36+
<PlatformToolset>v141_xp</PlatformToolset>
3637
<CharacterSet>MultiByte</CharacterSet>
3738
</PropertyGroup>
3839
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
3940
<ConfigurationType>StaticLibrary</ConfigurationType>
4041
<UseDebugLibraries>false</UseDebugLibraries>
41-
<PlatformToolset>v140_xp</PlatformToolset>
42+
<PlatformToolset>v141_xp</PlatformToolset>
4243
<WholeProgramOptimization>true</WholeProgramOptimization>
4344
<CharacterSet>MultiByte</CharacterSet>
4445
</PropertyGroup>
4546
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
4647
<ConfigurationType>StaticLibrary</ConfigurationType>
4748
<UseDebugLibraries>false</UseDebugLibraries>
48-
<PlatformToolset>v140_xp</PlatformToolset>
49+
<PlatformToolset>v141_xp</PlatformToolset>
4950
<WholeProgramOptimization>true</WholeProgramOptimization>
5051
<CharacterSet>MultiByte</CharacterSet>
5152
</PropertyGroup>

‎GleeBug/ntdll.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2511,7 +2511,7 @@ typedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32];
25112511
typedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64];
25122512
typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];
25132513

2514-
#define FLS_MAXIMUM_AVAILABLE 128
2514+
#define NTDLL_FLS_MAXIMUM_AVAILABLE 128
25152515
#define TLS_MINIMUM_AVAILABLE 64
25162516
#define TLS_EXPANSION_SLOTS 1024
25172517

@@ -2656,7 +2656,7 @@ typedef struct _PEB
26562656
PVOID* FlsCallback;
26572657
LIST_ENTRY FlsListHead;
26582658
PVOID FlsBitmap;
2659-
ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
2659+
ULONG FlsBitmapBits[NTDLL_FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
26602660
ULONG FlsHighIndex;
26612661

26622662
PVOID WerRegistrationData;

‎MyDebugger/MyDebugger.vcxproj

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,31 +21,32 @@
2121
<PropertyGroup Label="Globals">
2222
<ProjectGuid>{4083DE5A-582F-4B15-B6F0-CB866E66F8C4}</ProjectGuid>
2323
<RootNamespace>MyDebugger</RootNamespace>
24+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
2425
</PropertyGroup>
2526
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2627
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
2728
<ConfigurationType>Application</ConfigurationType>
2829
<UseDebugLibraries>true</UseDebugLibraries>
29-
<PlatformToolset>v140_xp</PlatformToolset>
30+
<PlatformToolset>v141_xp</PlatformToolset>
3031
<CharacterSet>MultiByte</CharacterSet>
3132
</PropertyGroup>
3233
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
3334
<ConfigurationType>Application</ConfigurationType>
3435
<UseDebugLibraries>true</UseDebugLibraries>
35-
<PlatformToolset>v140_xp</PlatformToolset>
36+
<PlatformToolset>v141_xp</PlatformToolset>
3637
<CharacterSet>MultiByte</CharacterSet>
3738
</PropertyGroup>
3839
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
3940
<ConfigurationType>Application</ConfigurationType>
4041
<UseDebugLibraries>false</UseDebugLibraries>
41-
<PlatformToolset>v140_xp</PlatformToolset>
42+
<PlatformToolset>v141_xp</PlatformToolset>
4243
<WholeProgramOptimization>true</WholeProgramOptimization>
4344
<CharacterSet>MultiByte</CharacterSet>
4445
</PropertyGroup>
4546
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
4647
<ConfigurationType>Application</ConfigurationType>
4748
<UseDebugLibraries>false</UseDebugLibraries>
48-
<PlatformToolset>v140_xp</PlatformToolset>
49+
<PlatformToolset>v141_xp</PlatformToolset>
4950
<WholeProgramOptimization>true</WholeProgramOptimization>
5051
<CharacterSet>MultiByte</CharacterSet>
5152
</PropertyGroup>

‎StaticEngine/StaticEngine.vcxproj

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,31 +21,32 @@
2121
<PropertyGroup Label="Globals">
2222
<ProjectGuid>{8E0C7F46-89CC-4510-BC17-07513A31BC7E}</ProjectGuid>
2323
<RootNamespace>StaticEngine</RootNamespace>
24+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
2425
</PropertyGroup>
2526
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2627
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
2728
<ConfigurationType>DynamicLibrary</ConfigurationType>
2829
<UseDebugLibraries>true</UseDebugLibraries>
29-
<PlatformToolset>v140_xp</PlatformToolset>
30+
<PlatformToolset>v141_xp</PlatformToolset>
3031
<CharacterSet>MultiByte</CharacterSet>
3132
</PropertyGroup>
3233
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
3334
<ConfigurationType>DynamicLibrary</ConfigurationType>
3435
<UseDebugLibraries>true</UseDebugLibraries>
35-
<PlatformToolset>v140_xp</PlatformToolset>
36+
<PlatformToolset>v141_xp</PlatformToolset>
3637
<CharacterSet>MultiByte</CharacterSet>
3738
</PropertyGroup>
3839
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
3940
<ConfigurationType>DynamicLibrary</ConfigurationType>
4041
<UseDebugLibraries>false</UseDebugLibraries>
41-
<PlatformToolset>v140_xp</PlatformToolset>
42+
<PlatformToolset>v141_xp</PlatformToolset>
4243
<WholeProgramOptimization>true</WholeProgramOptimization>
4344
<CharacterSet>MultiByte</CharacterSet>
4445
</PropertyGroup>
4546
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
4647
<ConfigurationType>DynamicLibrary</ConfigurationType>
4748
<UseDebugLibraries>false</UseDebugLibraries>
48-
<PlatformToolset>v140_xp</PlatformToolset>
49+
<PlatformToolset>v141_xp</PlatformToolset>
4950
<WholeProgramOptimization>true</WholeProgramOptimization>
5051
<CharacterSet>MultiByte</CharacterSet>
5152
</PropertyGroup>

‎StaticEngine/TitanEngine.h

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -599,6 +599,12 @@ typedef struct
599599
XmmRegister_t High; //AVX part
600600
} YmmRegister_t;
601601

602+
typedef struct
603+
{
604+
YmmRegister_t Low; //AVX part
605+
YmmRegister_t High; //AVX-512 part
606+
} ZmmRegister_t;
607+
602608
typedef struct
603609
{
604610
BYTE data[10];
@@ -664,6 +670,16 @@ typedef struct
664670
#endif
665671
} TITAN_ENGINE_CONTEXT_t;
666672

673+
typedef struct
674+
{
675+
#ifdef _WIN64
676+
ZmmRegister_t ZmmRegisters[32];
677+
#else // x86
678+
ZmmRegister_t ZmmRegisters[8];
679+
#endif
680+
ULONGLONG Opmask[8];
681+
} TITAN_ENGINE_CONTEXT_AVX512_t;
682+
667683
#ifdef __cplusplus
668684
extern "C"
669685
{
@@ -853,6 +869,8 @@ __declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD
853869
__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);
854870
__declspec(dllexport) bool TITCALL GetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);
855871
__declspec(dllexport) bool TITCALL SetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);
872+
__declspec(dllexport) bool TITCALL GetAVX512Context(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_AVX512_t* titcontext);
873+
__declspec(dllexport) bool TITCALL SetAVX512Context(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_AVX512_t* titcontext);
856874
__declspec(dllexport) void TITCALL ClearExceptionNumber();
857875
__declspec(dllexport) long TITCALL CurrentExceptionNumber();
858876
__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);

‎StaticEngine/TitanEngineEmulator.cpp

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,16 @@ __declspec(dllexport) void TITCALL Getx87FPURegisters(x87FPURegister_t x87FPUReg
171171
emu.Getx87FPURegisters(x87FPURegisters, titcontext);
172172
}
173173

174+
__declspec(dllexport) bool TITCALL GetAVX512Context(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_AVX512_t* titcontext)
175+
{
176+
return false;
177+
}
178+
179+
__declspec(dllexport) bool TITCALL SetAVX512Context(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_AVX512_t* titcontext)
180+
{
181+
return false;
182+
}
183+
174184
//PE
175185
__declspec(dllexport) bool TITCALL StaticFileLoad(const char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA)
176186
{

‎TitanEngineEmulator/Emulator.h

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1170,18 +1170,32 @@ class Emulator : public Debugger
11701170
return dwLastError;
11711171
}
11721172

1173+
static DWORD GetNtBuildNumberWindows7()
1174+
{
1175+
auto p_RtlGetVersion = (NTSTATUS(WINAPI*)(PRTL_OSVERSIONINFOW))GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "RtlGetVersion");
1176+
RTL_OSVERSIONINFOW info = { sizeof(info) };
1177+
if (p_RtlGetVersion && p_RtlGetVersion(&info) == 0)
1178+
return info.dwBuildNumber;
1179+
else
1180+
return 0;
1181+
}
1182+
1183+
static DWORD GetNtBuildNumber()
1184+
{
1185+
// https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1507%20Threshold%201/_KUSER_SHARED_DATA
1186+
auto NtBuildNumber = *(DWORD*)(0x7FFE0000 + 0x260);
1187+
if (NtBuildNumber == 0)
1188+
{
1189+
// Older versions of Windows
1190+
static DWORD NtBuildNumber7 = GetNtBuildNumberWindows7();
1191+
NtBuildNumber = NtBuildNumber7;
1192+
}
1193+
return NtBuildNumber;
1194+
}
1195+
11731196
static bool isAtleastVista()
11741197
{
1175-
static bool isAtleastVista = false;
1176-
static bool isSet = false;
1177-
if(isSet)
1178-
return isAtleastVista;
1179-
OSVERSIONINFO versionInfo = { 0 };
1180-
versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
1181-
GetVersionEx(&versionInfo);
1182-
isAtleastVista = versionInfo.dwMajorVersion >= 6;
1183-
isSet = true;
1184-
return isAtleastVista;
1198+
return GetNtBuildNumber() >= 6000;
11851199
}
11861200

11871201
//Quote from The Ultimate Anti-Debugging Reference by Peter Ferrie

‎TitanEngineEmulator/TitanEngine.h

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -603,6 +603,12 @@ typedef struct
603603
XmmRegister_t High; //AVX part
604604
} YmmRegister_t;
605605

606+
typedef struct
607+
{
608+
YmmRegister_t Low; //AVX part
609+
YmmRegister_t High; //AVX-512 part
610+
} ZmmRegister_t;
611+
606612
typedef struct
607613
{
608614
BYTE data[10];
@@ -668,6 +674,16 @@ typedef struct
668674
#endif
669675
} TITAN_ENGINE_CONTEXT_t;
670676

677+
typedef struct
678+
{
679+
#ifdef _WIN64
680+
ZmmRegister_t ZmmRegisters[32];
681+
#else // x86
682+
ZmmRegister_t ZmmRegisters[8];
683+
#endif
684+
ULONGLONG Opmask[8];
685+
} TITAN_ENGINE_CONTEXT_AVX512_t;
686+
671687
#ifdef __cplusplus
672688
extern "C"
673689
{
@@ -859,6 +875,8 @@ __declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD
859875
__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue);
860876
__declspec(dllexport) bool TITCALL GetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);
861877
__declspec(dllexport) bool TITCALL SetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext);
878+
__declspec(dllexport) bool TITCALL GetAVX512Context(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_AVX512_t* titcontext);
879+
__declspec(dllexport) bool TITCALL SetAVX512Context(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_AVX512_t* titcontext);
862880
__declspec(dllexport) void TITCALL ClearExceptionNumber();
863881
__declspec(dllexport) long TITCALL CurrentExceptionNumber();
864882
__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard);

0 commit comments

Comments
 (0)