balrog

~ ELF file analysis tool to be used after firmware extraction
git clone https://github.com/djnnvx/balrog.git
aarch64.rs (1397B)
      1 use super::{imm, mem, reg, Kind, Op};
      2 use capstone::arch::arm64::Arm64Reg;
      3 
      4 pub const ARG_REGS: [u16; 8] = [
      5     Arm64Reg::ARM64_REG_X0 as u16,
      6     Arm64Reg::ARM64_REG_X1 as u16,
      7     Arm64Reg::ARM64_REG_X2 as u16,
      8     Arm64Reg::ARM64_REG_X3 as u16,
      9     Arm64Reg::ARM64_REG_X4 as u16,
     10     Arm64Reg::ARM64_REG_X5 as u16,
     11     Arm64Reg::ARM64_REG_X6 as u16,
     12     Arm64Reg::ARM64_REG_X7 as u16,
     13 ];
     14 
     15 pub const SP: u16 = Arm64Reg::ARM64_REG_SP as u16;
     16 
     17 pub fn decode(mnemonic: &str, o: &[Op; 3]) -> Option<Kind> {
     18     match mnemonic {
     19         "bl" => Some(Kind::Call(imm(o, 0)? as u64)),
     20         "blr" => Some(Kind::CallInd { reg: reg(o, 0)? }),
     21         "ret" => Some(Kind::Ret),
     22         "adrp" | "adr" => Some(Kind::SetConst {
     23             dst: reg(o, 0)?,
     24             val: imm(o, 1)? as u64,
     25         }),
     26         "ldr" => {
     27             let (base, disp) = mem(o, 1)?;
     28             Some(Kind::Load {
     29                 dst: reg(o, 0)?,
     30                 base,
     31                 disp,
     32             })
     33         }
     34         "add" => Some(Kind::AddImm {
     35             dst: reg(o, 0)?,
     36             base: reg(o, 1)?,
     37             imm: imm(o, 2)?,
     38         }),
     39         "sub" => Some(Kind::AddImm {
     40             dst: reg(o, 0)?,
     41             base: reg(o, 1)?,
     42             imm: -imm(o, 2)?,
     43         }),
     44         "mov" => Some(Kind::Mov {
     45             dst: reg(o, 0)?,
     46             src: reg(o, 1)?,
     47         }),
     48         _ => None,
     49     }
     50 }