OSDev.org

Code: Select all

class blah {
  int func()
  { __asm("blah");}
};

Code: Select all

_mY3MANGLED_func_333:
  // compiler initialise stack frame
  mov ebp, esp
  push ...

  blah

  leave
  ret

Code: Select all

lkd> rdmsr 174
msr[174] = 00000000`00000008
lkd> rdmsr 175
msr[175] = 00000000`f8951000
lkd> rdmsr 176
msr[176] = 00000000`804de6f0

Code: Select all

Kernel Function Name 	Call style 	Exit instruction
KiSystemCallExit 	'int 2e' 	iretd
KiSystemCallExit2 	SYSENTER 	SYSEXIT
KiSystemCallExit3 	SYSCALL 	SYSRETURN

Code: Select all

08048430 <_ZN2cA1fEv>:
 8048430:       8b 44 24 04             mov    0x4(%esp),%eax
 8048434:       c7 00 01 00 00 00       movl   $0x1,(%eax)
 804843a:       c3                      ret
 804843b:       90                      nop
 804843c:       8d 74 26 00             lea    0x0(%esi),%esi

Code: Select all

0804841c <_ZN2cA1fEv>:
 804841c:       55                      push   %ebp
 804841d:       89 e5                   mov    %esp,%ebp
 804841f:       8b 45 08                mov    0x8(%ebp),%eax
 8048422:       c7 00 01 00 00 00       movl   $0x1,(%eax)
 8048428:       5d                      pop    %ebp
 8048429:       c3                      ret

Code: Select all

#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <stdarg.h>
#include <malloc.h>

class cA
{
	public:
	uint32_t val;
	cA()
	{
		val = 10;
	}
	~cA()
	{
		val = 20;
	}
	virtual void fa(){val = 1; printf("called me\n");}
	virtual void fb(){val = 1;}
	virtual void fc(){val = 1;}
	virtual void fd(){val = 1;}
};

extern uint8_t class_vfunc_wrapper_start;
extern uint8_t class_vfunc_wrapper_end;
extern uint8_t class_vfunc_wrapper_loadreg_prologcall;
extern uint8_t class_vfunc_wrapper_loadreg_membercall;
extern uint8_t class_vfunc_wrapper_loadreg_epilogcall;
void wrap_class_vfuncs(uintptr_t instance, uintptr_t prolog, uintptr_t epilog, uint32_t vfc, uint8_t count, ...)
{
	uintptr_t *vte = (uintptr_t*)((uintptr_t*)instance)[0];
	va_list ap;
	va_start(ap, count);

	// create a new virtual table.
	uint32_t *nvt = new uint32_t[vfc];
	for(uint32_t x = 0; x < vfc; ++x)
	{
		nvt[x] = vte[x];
	}
	// set new virtual table in instance.
	((uintptr_t*)instance)[0] = (uintptr_t)nvt;

	for(; count > 0; --count)
	{
		// yeild thirty-two bit index from byte index.
		uint32_t index = (va_arg(ap, uintptr_t) >> 2);
		// we found function's address in the vtable, create a wrapper instance.
		uint8_t *wrapperCode = (uint8_t*)memalign(32, (uintptr_t)&class_vfunc_wrapper_end - (uintptr_t)&class_vfunc_wrapper_start);
		// copy wrapper code into wrapper instance.
		memcpy(wrapperCode, &class_vfunc_wrapper_start, ((uintptr_t)&class_vfunc_wrapper_end) - ((uintptr_t)&class_vfunc_wrapper_start));
		printf("wrapper code size:%x\n", ((uintptr_t)&class_vfunc_wrapper_end) - ((uintptr_t)&class_vfunc_wrapper_start));
		// set wrapper instance call values (very hacky)
		*(uint32_t*)(((uintptr_t)&class_vfunc_wrapper_loadreg_prologcall - (uintptr_t)&class_vfunc_wrapper_start) + (uintptr_t)wrapperCode + 1) = prolog;
		*(uint32_t*)(((uintptr_t)&class_vfunc_wrapper_loadreg_epilogcall - (uintptr_t)&class_vfunc_wrapper_start) + (uintptr_t)wrapperCode + 1) = epilog;
		*(uint32_t*)(((uintptr_t)&class_vfunc_wrapper_loadreg_membercall - (uintptr_t)&class_vfunc_wrapper_start) + (uintptr_t)wrapperCode + 1) = vte[index];
		printf("vte:%x\n", vte[index]);
		nvt[index] = (uintptr_t)wrapperCode;
		printf("wrapped class member function, wrapper function address %x\n", wrapperCode);
	}
	return;
}

typedef void (*pmf)(void);

extern uint8_t example_prolog;
extern uint8_t example_epilog;

int main()
{
	cA *a = new cA();
	wrap_class_vfuncs((uintptr_t)a, (uintptr_t)&example_prolog, (uintptr_t)&example_epilog, 4, 1, &cA::fa);
	a->fa();
	a->fa();
	return 1;
}

Code: Select all

.global class_vfunc_wrapper_start
.global class_vfunc_wrapper_end
.global class_vfunc_wrapper_loadreg_prologcall
.global class_vfunc_wrapper_loadreg_membercall
.global class_vfunc_wrapper_loadreg_epilogcall
class_vfunc_wrapper_start:
class_vfunc_wrapper_loadreg_prologcall:
movl $0, %ebx
call *%ebx
class_vfunc_wrapper_loadreg_membercall:
movl $0, %ebx
movl 4(%esp), %eax
push %eax
call *%ebx
pop %edx
push %eax
class_vfunc_wrapper_loadreg_epilogcall:
movl $0, %ebx
call *%ebx
pop %eax
ret
class_vfunc_wrapper_end:

.global example_prolog
.global example_epilog
example_prolog:
ret
example_epilog:
ret

Code: Select all

class test {
  public:
    int MyAsmMethod(void);
    int MyCppMethod(void);
};

int test::MyCppMethod(void) {
    //- this is the c++ method
	return(1);
}

asm (
".global __ZN4test11MyAsmMethodEv;"
"__ZN4test11MyAsmMethodEv:"
"    movl       $2, %eax;"
"    ret;"
);

#include <iostream>
using namespace std;

int main(void) {
    test        x;

    cout << x.MyAsmMethod() << endl;
    cout << x.MyCppMethod() << endl;
}

Code: Select all

typedef class object {
friend void doStuff(object *);
}

asm ( ".global doStuff: ret");

Code: Select all

#define START_KERNEL \
  u32int was_ring_3 = 0;\
  if (isring3()) { \
    was_ring_3=1; asmStartKernel(); \
  }

#define END_KERNEL \
  if (was_ring_3) { \
    asmEndKernel(curProcess->esp0); \
  }

void Class::MemberFunc()
{
  START_KERNEL

  code...

  END_KERNEL
}

Code: Select all

asmStartKernel:
  ebx <- ebp  ; put the current stackframe base pointer in ebx
  ecx <- esp  ; and the current stack pointer
  eax <- .my_tmp_label ; EIP to jump to in eax.
  sysenter
.my_tmp_label:
  ret

; the location of this symbol is in the SYSENTER_EIP_MSR.
asmStartKernelHandler:
  push ebx ; push a pointer to the user stack base.
  ; copy the stack frame from the user stack using ecx, ebx.
  jmp eax

asmEndKernel:
  eax <- [esp+4]  ; eax  = first argument = esp0 = kernel stack base.
  esp <- [eax]     ; esp = dereference of esp0 = the pushed stackpointer.
  pop ebp ; restore the base pointer
  pop edx ; put the return addr in edx
  mov ecx, esp ; put the return esp in ecx for sysexit
  sysexit