readme updated: R_FS_BASE example

Cr4sh · Mar 16, 2015 · da9830c · da9830c
1 parent 678d1ad
commit da9830c
Show file tree

Hide file tree

Showing 3 changed files with 73 additions and 2 deletions.
diff --git a/COPYING b/COPYING
@@ -1,5 +1,5 @@
 
-Copyright © 2009, Dmytro Oleksiuk.
+Copyright (c) 2015, Dmytro Oleksiuk.
 
 See COPYING_BAP and AUTHORS_BAP for more information.
 
diff --git a/README.md b/README.md
@@ -213,6 +213,43 @@ Example of IR code for `mov ah, al` x86 instruction:
 00000000.04      OR          V_01:32,          V_03:32,         R_EAX:32
 ```
 
+Many operating systems uses `FS` segment register to access certain system structures. OpenREIL represents this segment register as `R_FS_BASE:32`. Here is an example of function that gets `_PEB` address of the current Windows process:
+
+```cpp
+ULONG_PTR get_peb(void)
+{
+#ifdef _X86_
+
+    return __readfsdword(0x30);
+
+#else _AMD64_
+
+    return __readgsqword(0x60);
+
+#endif
+}
+```
+
+And IR code of this function:
+
+```
+;
+; asm: mov eax, dword ptr fs:[0x30]
+; data (6): 64 a1 30 00 00 00
+;
+00401000.00     ADD     R_FS_BASE:32,            30:32,          V_04:32
+00401000.01      OR          V_04:32,             0:64,          V_05:64
+00401000.02     AND          V_05:64,      ffffffff:32,          V_10:32
+00401000.03     LDM          V_10:32,                 ,         R_EAX:32
+;
+; asm: ret
+; data (1): c3
+;
+00401006.00     LDM         R_ESP:32,                 ,          V_01:32
+00401006.01     ADD         R_ESP:32,             4:32,         R_ESP:32
+00401006.02     JCC              1:1,                 ,          V_01:32
+```
+
 
 ### Representation of x86 EFLAGS <a id="_3_4"></a>
 

diff --git a/docs/README.html b/docs/README.html
@@ -407,6 +407,40 @@ <h3>
 00000000.04      OR          V_01:32,          V_03:32,         R_EAX:32
 </code></pre>
 
+<p>Many operating systems uses <code>FS</code> segment register to access certain system structures. OpenREIL represents this segment register as <code>R_FS_BASE:32</code>. Here is an example of function that gets <code>_PEB</code> address of the current Windows process:</p>
+
+<div class="highlight highlight-cpp"><pre>ULONG_PTR <span class="pl-en">get_peb</span>(<span class="pl-st">void</span>)
+{
+#<span class="pl-k">ifdef</span> _X86_
+
+    <span class="pl-k">return</span> <span class="pl-s3">__readfsdword</span>(0x30);
+
+#<span class="pl-k">else</span> _AMD64_
+
+    <span class="pl-k">return</span> <span class="pl-s3">__readgsqword</span>(0x60);
+
+#<span class="pl-k">endif</span>
+}</pre></div>
+
+<p>And IR code of this function:</p>
+
+<pre><code>;
+; asm: mov eax, dword ptr fs:[0x30]
+; data (6): 64 a1 30 00 00 00
+;
+00401000.00     ADD     R_FS_BASE:32,            30:32,          V_04:32
+00401000.01      OR          V_04:32,             0:64,          V_05:64
+00401000.02     AND          V_05:64,      ffffffff:32,          V_10:32
+00401000.03     LDM          V_10:32,                 ,         R_EAX:32
+;
+; asm: ret
+; data (1): c3
+;
+00401006.00     LDM         R_ESP:32,                 ,          V_01:32
+00401006.01     ADD         R_ESP:32,             4:32,         R_ESP:32
+00401006.02     JCC              1:1,                 ,          V_01:32
+</code></pre>
+
 <h3>
 <a id="user-content-representation-of-x86-eflags-" class="anchor" href="#representation-of-x86-eflags-" aria-hidden="true"><span class="octicon octicon-link"></span></a>Representation of x86 EFLAGS <a id="user-content-_3_4"></a>
 </h3>
@@ -616,7 +650,7 @@ <h3>
 <a id="user-content-low-level-translation-api-" class="anchor" href="#low-level-translation-api-" aria-hidden="true"><span class="octicon octicon-link"></span></a>Low level translation API <a id="user-content-_5_1"></a>
 </h3>
 
-<p>OpenREIL has low level translation API that returns IR instructions as Python tuple. Here is en example of decoding <code>push eax</code> x86 instruction using this API:</p>
+<p>OpenREIL has low level translation API that returns IR instructions as Python tuple. Here is an example of decoding <code>push eax</code> x86 instruction using this API:</p>
 
 <div class="highlight highlight-python"><pre><span class="pl-k">from</span> pyopenreil <span class="pl-k">import</span> translator
 <span class="pl-k">from</span> pyopenreil.REIL <span class="pl-k">import</span> ARCH_X86