-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathSmaliAssemblyInstructions.py
2361 lines (1768 loc) · 81.2 KB
/
SmaliAssemblyInstructions.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# SmaliAssemblyInstructions.py
#
# Each of these classes is basically in thin wrapper around a string
# They correspond to the instructions for smali bytecode as listed
# here: http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html
# Implementation is incomplete. Only the instructions necessary
# for taint-tracking implementation of the stigma project are present.
# When adding a new class to this file
# please consider the class hierarchy so far
# (please update this comment)
#
# Should the new class be a child of SmaliAssemblyInstruction?
# Should the new class be a child of MOVE?
# Should the new class be a child of _SINGLE_DEST_REGISTER_INSTRUCTION?
# * Note: _SINGLE_DEST_REGISTER_INSTRUCTION is any instruction that
# only has ONE parameter; a register that serves as a destination.
# Should the new class be a child of CONST?
# Should the new class be a child of MOVE-RESULT?
# Here are some of the "abstract" parent classes
# _SINGLE_REGISTER_INSTRUCTION
# _SINGLE_DEST_REGISTER_INSTRUCTION
# _PARAMETER_LIST_INSTRUCTION
# _TRIPLE_REGISTER_INSTRUCTION
# _TWO_REG_EQ
# _ONE_REG_EQ_ZERO
# _I_INSTRUCTION
# _I_INSTRUCTION_QUICK
# _S_INSTRUCTION
# _INVOKE_INSTRUCTION
# _TWO_REGISTER_UNARY_INSTRUCTION
# _TWO_REGISTER_BINARY_INSTRUCTION
# _TWO_REGISTER_AND_LITERAL_BINARY_INSTRUCTION
import StigmaStringParsingLib
import SmaliTypes
from SmaliRegister import SmaliRegister
class SmaliAssemblyInstruction():
@staticmethod
def from_line(raw_line_string):
#print("constructing SmaliAssemblyInstruction From: " + str(raw_line_string))
line = raw_line_string.strip("\n")
if(StigmaStringParsingLib.is_comment(line)):
return COMMENT(line)
hash_pos = line.find("#")
if hash_pos != -1:
# for now, delete "in-line" comments since they're a pain to retain
line = line[:hash_pos]
tokens = StigmaStringParsingLib.break_into_tokens(line)
#tokens = list(filter(lambda x: x != "", tokens)) # removes ""
#print("tokens: " + str(tokens))
if(len(tokens) == 0):
return BLANK_LINE()
opcode = tokens[0]
if(opcode_has_parameter_list(opcode) or opcode_has_parameter_range(opcode)):
start = line.index("{")
end = line.index("}")
args = line[start+1:end]
#print("HERE")
#print(args)
if args == "":
args = "[]"
else:
args = args.split(" ")
args = str(list(map(lambda x : x.strip(","), args)))
args = [ args ]
args.append("\"" + tokens[-1] + "\"")
#print("args before: " + str(args))
else:
args = tokens[1:]
#print("args before: " + str(args))
args = list(map(lambda x : "\"" + str(x.strip(",")) + "\"", args))
#print("args: " + str(args))
opcode = opcode.upper()
opcode = opcode.replace("/", "_")
opcode = opcode.replace("-", "_")
if(opcode == "CONST_STRING" or opcode == "CONST_STRING_JUMBO"):
smali_assembly_instruction = SmaliAssemblyInstruction._build_const_string(opcode, line)
return smali_assembly_instruction
else:
eval_string = opcode + "(" + ", ".join(args) + ")"
# example input line: " move/from16 v1, v25"
# output eval_string: "MOVE_FROM16("v1", "v25")"
#print("eval_string: " + eval_string)
# this next part is very very technical and feels
# pretty hacky
# https://www.programiz.com/python-programming/methods/built-in/eval
# https://stackoverflow.com/questions/3941517/converting-list-to-args-when-calling-function#3941529
smali_assembly_instruction_obj = eval(eval_string)
return smali_assembly_instruction_obj
def __str__(self):
return " " + repr(self) + "\n"
@staticmethod
def _build_const_string(opcode, whole_line):
# examples of const-string and const-string/jumbo
# const-string v3, "android.permission.READ_PHONE_STATE"
# const-string v4, " hostName: "
# const-string v3, "this ain\'t it!"
# const-string v5, "AudioTrack failed to initialize (status "
#
# const-string/jumbo v1, "unrated"\n'
# const-string/jumbo v2, "yyyy-MM-dd\'T\'HH:mm:ss.SSS\'Z\'"
s = whole_line.split(", ")[-1]
#print("s:", s)
tokens = StigmaStringParsingLib.break_into_tokens(whole_line)
reg = tokens[1].strip(", ")
#print("reg:", reg)
if(opcode == "CONST_STRING"):
asm_obj = CONST_STRING()
elif(opcode == "CONST_STRING_JUMBO"):
asm_obj = CONST_STRING_JUMBO()
else:
raise ValueError("Instruction mis-identified as const-string:", whole_line)
asm_obj.set_dest_reg(reg)
asm_obj.set_string(s)
return asm_obj
def get_registers(self):
return []
def get_p_registers(self):
return list(filter(lambda x : x[0] == "p", self.get_registers()))
def get_implicit_registers(self):
return []
def __eq__(self, other):
return repr(self) == repr(other)
def get_move(self):
return MOVE_16
def get_unique_registers(self):
ans = []
for item in self.get_registers():
if(item not in ans):
ans.append(item)
return ans
def get_register_type_implications(self):
# NOTE, for all implementations of this method
# the result should be the types AFTER the instruction
# has executed. This has important / tricky complications
# with instructions that re-use the src and dest reg
# e.g., int-to-long v3, v3
return {}
class _ImplicitRegistersInstruction():
# instructions that have implicit registers
# all such cases are "wide" instructions that
# work with 64-bit types Long, or Double
def get_implicit_registers(self):
ans = []
for reg in self.get_registers():
implicit_reg = reg + 1
ans.append(implicit_reg)
return ans
class _ImplicitFirstRegisterInstruction():
# the first register (and only that register)
# specifies a "wide" type such as Long or Double
def get_implicit_registers(self):
regs = self.get_registers()
return [regs[0] + 1]
class _MethodCallInstruction():
def get_fully_qualified_call(self):
return self.types_spec
def get_owning_class_name(self):
parts = self.types_spec.split("->")
return parts[0]
def get_method_name(self):
parts = self.types_spec.split("->")
return parts[1]
def get_method_name_only(self):
parts = self.types_spec.split("->")
name_only = parts[1].split("(")[0]
return name_only
class _ThirtyTwoBit_Parameters():
# instruction classes that extend this type
# are those in which ALL the registers/parameters
# are 32-bit types
def get_register_type_implications(self):
ans = {}
for reg in self.get_registers():
ans[reg] = SmaliTypes.ThirtyTwoBit()
return ans
class _Object_Parameters():
# instruction classes that extend this type
# are those in which ALL the registers/parameters
# are object types
def get_register_type_implications(self):
ans = {}
for reg in self.get_registers():
ans[reg] = SmaliTypes.NonSpecificObjectReference()
return ans
class _SixtyFourBit_Dest():
# instruction classes that extend this type
# are those in which ALL the registers/parameters
# are wide / "64-bit" types
def get_register_type_implications(self):
# consider the follow example
# e.g., add-long v6, v0, v5
# this instruction (found in the wild) re-writes
# v6 from it's incoming value (64-bit-2) to
# it's new value (64-bit) outgoing
# thereby invalidating the value stored in v5
# because of this annoying edge-case I chose to implement
# type implications only for the dest reg
explicit_regs = self.get_registers()
implicit_regs = self.get_implicit_registers()
ans = {}
ans[explicit_regs[0]] = SmaliTypes.SixtyFourBit()
ans[implicit_regs[0]] = SmaliTypes.SixtyFourBit_2()
return ans
#class _NoType_OR_NoParameters():
# instruction classes that extend this type
# are those in which (1) there are no parameters
# or (2) the parameters given do not have any type rules
# def get_register_type_implications(self):
# return {}
class NOP(SmaliAssemblyInstruction):
def __repr__(self):
return self.opcode()
def opcode(self):
return "nop"
class INVOKE_DIRECT_EMPTY(NOP):
# could not find any instance of this instruction
# in our APK files
# From the documentation:
# "Stands as a placeholder for pruned empty methods
# like Object.<init>. This acts as nop during
# normal execution."
def opcode(self):
return "invoke-direct-empty"
class BLANK_LINE(SmaliAssemblyInstruction):
def __repr__(self):
return ""
class COMMENT(SmaliAssemblyInstruction):
def __init__(self, line):
self.l = line
def __repr__(self):
return "# " + self.l
class MOVE(_ThirtyTwoBit_Parameters, SmaliAssemblyInstruction):
def __init__(self, reg1, reg2):
self.reg1 = SmaliRegister(reg1)
self.reg2 = SmaliRegister(reg2)
def get_registers(self):
if(self.reg1 == ""):
raise UnboundLocalError("reg1")
if(self.reg2 == ""):
raise UnboundLocalError("reg2")
return [self.reg1, self.reg2]
def opcode(self):
return "move"
def __repr__(self):
return self.opcode() + " " + str(self.reg1) + ", " + str(self.reg2)
class MOVE_16(MOVE):
# this might not exist
# I couldn't find any occurrences in the smali of leaks
def opcode(self):
return "move/16"
def __repr__(self):
return self.opcode() + " " + str(self.reg1) + ", " + str(self.reg2)
# This is a problem
# I need the class name to be MOVE/FROM16
# but "/" is not a valid character in a class name
class MOVE_FROM16(MOVE):
def opcode(self):
return "move/from16"
def __repr__(self):
return self.opcode() + " " + str(self.reg1) + ", " + str(self.reg2)
# This is a minor inconvenience
# I need the class name to be MOVE-WIDE
# but "-" is not a valid character in a class name
class MOVE_WIDE(_SixtyFourBit_Dest, _ImplicitRegistersInstruction, MOVE):
def opcode(self):
return "move-wide"
class MOVE_WIDE_FROM16(MOVE_WIDE):
def opcode(self):
return "move-wide/from16"
class MOVE_WIDE_16(MOVE_WIDE):
def opcode(self):
return "move-wide/16"
class MOVE_OBJECT(_Object_Parameters, MOVE):
def opcode(self):
return "move-object"
class MOVE_OBJECT_FROM16(MOVE_OBJECT):
def opcode(self):
return "move-object/from16"
class MOVE_OBJECT_16(MOVE_OBJECT):
def opcode(self):
return "move-object/16"
class _SINGLE_REGISTER_INSTRUCTION(SmaliAssemblyInstruction):
def __init__(self, reg_dest):
self.rd = SmaliRegister(reg_dest)
def get_registers(self):
return [self.rd]
def __repr__(self):
return self.opcode() + " " + str(self.rd)
class _SINGLE_DEST_REGISTER_INSTRUCTION(SmaliAssemblyInstruction):
# A parent class that should never be instantiated directly.
# * Note: _SINGLE_DEST_REGISTER_INSTRUCTION is any instruction that
# only has ONE parameter; a register that serves as a destination.
def __init__(self, reg_dest, value_arg):
self.rd = SmaliRegister(reg_dest)
self.value_arg = value_arg
def get_registers(self):
return [self.rd]
def __repr__(self):
return self.opcode() + " " + str(self.rd) + ", " + str(self.value_arg)
class MOVE_RESULT(_ThirtyTwoBit_Parameters, _SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "move-result"
class MOVE_RESULT_WIDE(_SixtyFourBit_Dest, _ImplicitRegistersInstruction, _SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "move-result-wide"
class MOVE_RESULT_OBJECT(_Object_Parameters, _SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "move-result-object"
class MOVE_EXCEPTION(_Object_Parameters, _SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "move-exception"
class RETURN_VOID(SmaliAssemblyInstruction):
def opcode(self):
return "return-void"
def __repr__(self):
return self.opcode()
class RETURN(_ThirtyTwoBit_Parameters, _SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "return"
class RETURN_WIDE(_SixtyFourBit_Dest, _ImplicitRegistersInstruction, _SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "return-wide"
class RETURN_OBJECT(_Object_Parameters, _SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "return-object"
class CONST(_ThirtyTwoBit_Parameters, _SINGLE_DEST_REGISTER_INSTRUCTION):
def opcode(self):
return "const"
class CONST_4(CONST):
def opcode(self):
return "const/4"
class CONST_16(CONST):
def opcode(self):
return "const/16"
class CONST_HIGH16(CONST):
def opcode(self):
return "const/high16"
class CONST_WIDE(_ImplicitRegistersInstruction, _SixtyFourBit_Dest, CONST):
def opcode(self):
return "const-wide"
class CONST_WIDE_16(CONST_WIDE):
def opcode(self):
return "const-wide/16"
class CONST_WIDE_32(CONST_WIDE):
def opcode(self):
return "const-wide/32"
class CONST_WIDE_HIGH16(CONST_WIDE):
def opcode(self):
return "const-wide/high16"
class CONST_STRING(SmaliAssemblyInstruction):
# const-string v3, "this ain\'t it!"
# const-string v5, "AudioTrack failed to initialize (status "
#
# const-string/jumbo v1, "unrated"\n'
# const-string/jumbo v2, "yyyy-MM-dd\'T\'HH:mm:ss.SSS\'Z\'"
def __init__(self, reg = "", new_string = ""):
# this constructor is invoked in the instrumenters
# that write explicit const-string instructions
# (for example to write the stigma logcat messages
# inovking Log.d())
self.rd = reg
self.str = new_string
def set_dest_reg(self, new_reg):
# used in the from_line so that
# const-string is not instantiated with eval()
# which is (a) better security (marginally)
# and (b) easier to code up
# since it means we don't have to worry about escaping
# escape characters _in the string_
self.rd = SmaliRegister(new_reg)
def set_string(self, new_string):
# used in the from_line so that
# const-string is not instantiated with eval()
# which is (a) better security (marginally)
# and (b) easier to code up
# since it means we don't have to worry about escaping
# escape characters _in the string_
self.str = new_string
def get_registers(self):
return [self.rd]
def __repr__(self):
return self.opcode() + " " + str(self.rd) + ", " + self.str
def opcode(self):
return "const-string"
def get_register_type_implications(self):
return {self.rd: SmaliTypes.ObjectReference("Ljava/lang/String;")}
class CONST_STRING_JUMBO(CONST_STRING):
# https://stackoverflow.com/questions/19991833/in-dalvik-what-expression-will-generate-instructions-not-int-and-const-strin
# found one in com.amazon.avod.thirdpartyclient.apk
# const-string/jumbo v5, "stackTrace"
# const-string/jumbo v1, "unrated"
def opcode(self):
return "const-string/jumbo"
def get_register_type_implications(self):
return {self.rd: SmaliTypes.ObjectReference("Ljava/lang/String;")}
class CONST_CLASS(_Object_Parameters, _SINGLE_DEST_REGISTER_INSTRUCTION):
def opcode(self):
return "const-class"
def __repr__(self):
return self.opcode() + " " + str(self.rd) + ", " + str(self.value_arg)
class MONITOR_ENTER(_SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "monitor-enter"
class MONITOR_EXIT(_SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "monitor-exit"
class CHECK_CAST( _Object_Parameters, _SINGLE_DEST_REGISTER_INSTRUCTION):
def opcode(self):
return "check-cast"
def get_register_type_implications(self):
return {self.rd: SmaliTypes.from_string(self.value_arg)}
class INSTANCE_OF(SmaliAssemblyInstruction):
def __init__(self, reg_res, reg_arg, type_id):
self.rr = SmaliRegister(reg_res)
self.ra = SmaliRegister(reg_arg)
self.type_id = type_id
def get_registers(self):
return [self.rr, self.ra]
def opcode(self):
return "instance-of"
def __repr__(self):
return self.opcode() + " " + str(self.rr) + ", " + str(self.ra) + ", " + str(self.type_id)
def get_register_type_implications(self):
res = {self.ra: SmaliTypes.NonSpecificObjectReference()}
res[self.rr] = SmaliTypes.ThirtyTwoBit()
return res
class NEW_INSTANCE(SmaliAssemblyInstruction):
def __init__(self, reg_dest, type_id):
self.rd = SmaliRegister(reg_dest)
self.type_id = type_id
def get_registers(self):
return [self.rd]
def opcode(self):
return "new-instance"
def __repr__(self):
return self.opcode() + " " + str(self.rd) + ", " + str(self.type_id)
def get_register_type_implications(self):
return {self.rd: SmaliTypes.from_string(self.type_id)}
class ARRAY_LENGTH(SmaliAssemblyInstruction):
# e.g., array-length v0, p2
def __init__(self, reg_dest, reg_array_ref):
self.rd = SmaliRegister(reg_dest)
self.rar = SmaliRegister(reg_array_ref)
def get_registers(self):
return [self.rd, self.rar]
def opcode(self):
return "array-length"
def __repr__(self):
return self.opcode() + " " + str(self.rd) + ", " + str(self.rar)
def get_register_type_implications(self):
ans = {self.rar: SmaliTypes.NonSpecificArray()}
ans[self.rd] = SmaliTypes.ThirtyTwoBit()
return ans
class NEW_ARRAY(SmaliAssemblyInstruction):
# e.g., new-array v3, v5, [Ljava/lang/String;
def __init__(self, reg_dest, reg_size, type_id):
self.rd = SmaliRegister(reg_dest)
self.rs = SmaliRegister(reg_size)
self.type_id = type_id
def get_registers(self):
return [self.rd, self.rs]
def opcode(self):
return "new-array"
def __repr__(self):
return self.opcode() + " " + str(self.rd) + ", " + str(self.rs) + ", " + str(self.type_id)
def get_register_type_implications(self):
ans = {self.rs: SmaliTypes.ThirtyTwoBit()}
ans[self.rd] = SmaliTypes.Array(self.type_id)
return ans
class _PARAMETER_LIST_INSTRUCTION(SmaliAssemblyInstruction):
# Not an ImplicitRegistersInstruction because both registers
# for a wide-type will be explicitly listed in the parameter list
def __init__(self, element_list, types_spec):
self.register_list = [SmaliRegister(r) for r in element_list]
self.types_spec = types_spec
def get_registers(self):
return self.register_list
def __repr__(self):
string_register_list = [str(x) for x in self.register_list]
reg_string = ", ".join(string_register_list)
return self.opcode() + " {" + reg_string + "}, " + str(self.types_spec)
class _PARAMETER_RANGE_INSTRUCTION(SmaliAssemblyInstruction):
# Not an ImplicitRegistersInstruction because both registers
# for a wide-type will be explicitly listed in the parameter list
def __init__(self, element_list, types_spec):
self.begin_reg = SmaliRegister(element_list[0])
self.end_reg = SmaliRegister(element_list[-1])
self.types_spec = types_spec
self.register_list = self.get_registers()
def get_registers(self):
if(self.begin_reg.letter() != "v" or self.end_reg.letter() != "v"):
raise ValueError("Cannot expand register range [" + str(self))
ans = []
for x in range(self.begin_reg.number(), self.end_reg.number()+1):
sr = SmaliRegister.from_components("v", x)
ans.append(sr)
return ans
def __repr__(self):
return self.opcode() + " {" + str(self.begin_reg) + " .. " + str(self.end_reg) + "}, " + str(self.types_spec)
class FILLED_NEW_ARRAY(_PARAMETER_LIST_INSTRUCTION):
# e.g., filled-new-array {v0, v1, v2, v3}, [Ljava/lang/String;
def opcode(self):
return "filled-new-array"
def get_register_type_implications(self):
ans = {}
for reg in self.get_registers():
ans[reg] = SmaliTypes.from_string(self.type_id)
return ans
class FILLED_NEW_ARRAY_RANGE(_PARAMETER_RANGE_INSTRUCTION):
# e.g., filled-new-array/range {v10 .. v16}, [Ljava/lang/String;
def opcode(self):
return "filled-new-array/range"
def get_register_type_implications(self):
array_content_type = SmaliTypes.from_string(self.types_spec).unwrap_layer()
ans = {}
for reg in self.get_registers():
ans[reg] = array_content_type
return ans
class FILL_ARRAY_DATA(_SINGLE_DEST_REGISTER_INSTRUCTION):
# e.g., fill-array-data v2, :array_ea
def opcode(self):
return "fill-array-data"
def get_register_type_implications(self):
return {self.rd: SmaliTypes.NonSpecificArray()}
class THROW(_SINGLE_REGISTER_INSTRUCTION):
def opcode(self):
return "throw"
def get_register_type_implications(self):
return {self.rd: SmaliTypes.NonSpecificObjectReference()}
class GOTO(SmaliAssemblyInstruction):
def __init__(self, target):
self.target = target
def opcode(self):
return "goto"
def __repr__(self):
return self.opcode() + " " + str(self.target)
class GOTO_16(GOTO):
def opcode(self):
return "goto/16"
class GOTO_32(GOTO):
def opcode(self):
return "goto/32"
class PACKED_SWITCH(_SINGLE_DEST_REGISTER_INSTRUCTION):
# NOTE: there is ALSO a .packed-switch and .sparse-switch
# compiler directive in smali
# e.g., .packed-switch -0x9
# this object implements the instruction packed-switch vX, :pswitch_data_Y
# I'm not sure what type vX holds, maybe int?
def opcode(self):
return "packed-switch"
class SPARSE_SWITCH(_SINGLE_DEST_REGISTER_INSTRUCTION):
def opcode(self):
return "sparse-switch"
class _TRIPLE_REGISTER_INSTRUCTION(SmaliAssemblyInstruction):
# A parent class that should never be instantiated directly
def __init__(self, reg_dest, reg_arg1, reg_arg2):
self.rd = SmaliRegister(reg_dest)
self.ra1 = SmaliRegister(reg_arg1)
self.ra2 = SmaliRegister(reg_arg2)
def get_registers(self):
return [self.rd, self.ra1, self.ra2]
def __repr__(self):
return self.opcode() + " " + str(self.rd) + ", " + str(self.ra1) + ", " + str(self.ra2)
class CMPL_FLOAT( _ThirtyTwoBit_Parameters, _TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "cmpl-float"
class CMPG_FLOAT(_ThirtyTwoBit_Parameters, _TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "cmpg-float"
class CMPL_DOUBLE(_TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "cmpl-double"
def get_implicit_registers(self):
regs = self.get_registers()
ans = []
for reg in regs[1:]:
implicit_reg = reg + 1
ans.append(implicit_reg)
return ans
def get_register_type_implications(self):
ans = {}
for reg in self.get_registers():
ans[reg] = SmaliTypes.SixtyFourBit()
for reg in self.get_implicit_registers():
ans[reg] = SmaliTypes.SixtyFourBit_2()
ans[self.rd] = SmaliTypes.ThirtyTwoBit()
return ans
class CMPG_DOUBLE(_TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "cmpg-double"
def get_implicit_registers(self):
regs = self.get_registers()
ans = []
for reg in regs[1:]:
implicit_reg = reg + 1
ans.append(implicit_reg)
return ans
def get_register_type_implications(self):
ans = {}
for reg in self.get_registers():
ans[reg] = SmaliTypes.SixtyFourBit()
for reg in self.get_implicit_registers():
ans[reg] = SmaliTypes.SixtyFourBit_2()
ans[self.rd] = SmaliTypes.ThirtyTwoBit()
return ans
class CMP_LONG(_TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "cmp-long"
def get_implicit_registers(self):
regs = self.get_registers()
ans = []
for reg in regs[1:]:
implicit_reg = reg + 1
ans.append(implicit_reg)
return ans
def get_register_type_implications(self):
ans = {}
for reg in self.get_registers():
ans[reg] = SmaliTypes.SixtyFourBit()
for reg in self.get_implicit_registers():
ans[reg] = SmaliTypes.SixtyFourBit_2()
ans[self.rd] = SmaliTypes.ThirtyTwoBit()
return ans
class _TWO_REG_EQ(SmaliAssemblyInstruction):
# A parent class that should never be instantiated directly
def __init__(self, reg_arg1, reg_arg2, target):
self.ra1 = SmaliRegister(reg_arg1)
self.ra2 = SmaliRegister(reg_arg2)
self.target = target
def get_registers(self):
return [self.ra1, self.ra2]
def __repr__(self):
return self.opcode() + " " + str(self.ra1) + ", " + str(self.ra2) + ", " + str(self.target)
class IF_EQ(_TWO_REG_EQ):
def opcode(self):
return "if-eq"
class IF_NE(_TWO_REG_EQ):
def opcode(self):
return "if-ne"
class IF_LT(_TWO_REG_EQ):
def opcode(self):
return "if-lt"
class IF_GE(_TWO_REG_EQ):
def opcode(self):
return "if-ge"
class IF_GT(_TWO_REG_EQ):
def opcode(self):
return "if-gt"
class IF_LE(_TWO_REG_EQ):
def opcode(self):
return "if-le"
class _ONE_REG_EQ_ZERO(SmaliAssemblyInstruction):
# A parent class that should never be instantiated directly
def __init__(self, reg_arg, target):
self.ra = SmaliRegister(reg_arg)
self.target = target
def get_registers(self):
return [self.ra]
def __repr__(self):
# It might be necessary to use repr(self.target)
# here because self.target might be a smali.LABEL
# object or it might be a string.
# If it is a smali.LABEL object
# then we use repr to get a string that does not contain
# the preceding four spaces and trailing \n which would be
# redundant LABELS are weird because it is possible to use a
# LABEL in-line
# This could be a bug in other classes, maybe re-write
# the LABEL(SmaliAssemblyInstruction) class
return self.opcode() + " " + str(self.ra) + ", " + str(self.target)
class IF_EQZ(_ONE_REG_EQ_ZERO):
def opcode(self):
return "if-eqz"
class IF_NEZ(_ONE_REG_EQ_ZERO):
def opcode(self):
return "if-nez"
class IF_LTZ(_ONE_REG_EQ_ZERO):
def opcode(self):
return "if-ltz"
class IF_GEZ(_ONE_REG_EQ_ZERO):
def opcode(self):
return "if-gez"
class IF_GTZ(_ONE_REG_EQ_ZERO):
def opcode(self):
return "if-gtz"
class IF_LEZ(_ONE_REG_EQ_ZERO):
def opcode(self):
return "if-lez"
class _Array_Parameters_Type_Pattern():
def get_register_type_implications(self):
# aget vX, vY, vZ
# vX dest (or src for aput-* instructions)
# vY a reference to an array
# vZ index / offset into array (I think this must be a 32-bit int)
self.ans = {}
self.ans[self.ra1] = SmaliTypes.NonSpecificArray()
self.ans[self.ra2] = SmaliTypes.Int()
# this should be done last for situations such as
# aget v4, v4, v6
# where self.rd should definitely have final decision
# about the type of v4
self._set_first_param_type()
return self.ans
class AGET(_Array_Parameters_Type_Pattern, _TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "aget"
def _set_first_param_type(self):
self.ans[self.rd] = SmaliTypes.ThirtyTwoBit()
class AGET_WIDE(_Array_Parameters_Type_Pattern, _ImplicitFirstRegisterInstruction, _TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "aget-wide"
def _set_first_param_type(self):
self.ans[self.rd] = SmaliTypes.SixtyFourBit()
self.ans[self.rd + 1] = SmaliTypes.SixtyFourBit_2()
class AGET_OBJECT(_Array_Parameters_Type_Pattern, _TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "aget-object"
def _set_first_param_type(self):
# this is a special case and should be treated as such!
# it really should check the type of vY and do an unwrap_layer()
# but that's not possible in this class / context
# because we don't have a register_type_map
#
# NonSpecificObjectReference as a very low specificity level
self.ans[self.rd] = SmaliTypes.NonSpecificObjectReference()
class AGET_BOOLEAN(_Array_Parameters_Type_Pattern, _TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "aget-boolean"
def _set_first_param_type(self):
self.ans[self.rd] = SmaliTypes.Boolean()
class AGET_BYTE(_Array_Parameters_Type_Pattern, _TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "aget-byte"
def _set_first_param_type(self):
self.ans[self.rd] = SmaliTypes.Byte()
class AGET_CHAR(_Array_Parameters_Type_Pattern, _TRIPLE_REGISTER_INSTRUCTION):
def opcode(self):
return "aget-char"