libvmcu Virtual MCU Library下載libvmcu Virtual MCU Library源代碼下載

libvmcu-虛擬MCU庫

LIBVMCU是一種用於靜態和動態分析AVR微控制器二進製文件的小型發動機。

它需要處理原始數據的準備，然後可以通過其他程序進一步處理。這裡的目的是使與AVR源代碼進行編程交互成為可能。

libvmcu為您提供

分析AVR組裝而無需進一步依賴的簡單方法。
從二進制中提取的定向控制流圖
拆卸和分解指示的代表
抽象隱式/明確的讀/寫內存訪問信息
中斷向量，字符串，...的分析儀模塊...
從/到分解指令的交叉引用
還有更多...

注意：該庫仍在開發中。

例子

二進制的打印控制流

 /* A possible implementation of print_instruction can be found below */

int main ( const int argc , const char * * argv ) {
    
    /* ignoring checks for this example */
    vmcu_model_t  * m328p  = vmcu_model_ctor ( VMCU_DEVICE_M328P );
    vmcu_report_t * report = vmcu_analyze_file ( "file.hex" , m328p );

    for ( uint32_t i = 0 ; i < report -> cfg -> used ; i ++ ) {
        
        vmcu_cfg_node_t * node = & report -> cfg -> node [ i ];
        print_instruction ( node -> xto . i );
        
        if ( node -> t != NULL ) {
            
            printf ( "true  -> " );
            print_instruction ( node -> t -> xto . i );
        }
        
        if ( node -> f != NULL ) {
            
            printf ( "false -> " );
            print_instruction ( node -> f -> xto . i );
        }
        
        printf ( "n" );
    } 
    
    vmcu_report_dtor ( report );
    vmcu_model_dtor ( m328p );
    
    return EXIT_SUCCESS ;
}

         0x0000  .... f1f3  breq - 2         ; (ZF == 1): PC <- PC + -2 + 1
true  - > 0x3fff  .... 839a  sbi 0x10 , 3     ; IO[0x10, 3] <- 1
false - > 0x0001  .... 0fef  ldi r16 , 0xff   ; r16 <- 0xff
--------------------------------------------------------------------------------
         0x0001  .... 0fef  ldi r16 , 0xff   ; r16 <- 0xff
true  - > 0x0002  .... 5817  cp r21 , r24     ; r21 - r24
--------------------------------------------------------------------------------
         0x0002  .... 5817  cp r21 , r24     ; r21 - r24
true  - > 0x0003  .... 19f4  brne 3          ; (ZF == 0): PC <- PC + 3 + 1
--------------------------------------------------------------------------------
         0x0003  .... 19f4  brne 3          ; (ZF == 0): PC <- PC + 3 + 1
true  - > 0x0007  .... 0127  eor r16 , r17    ; r16 <- r16 ^ r17
false - > 0x0004  .... a895  wdr             ; watchdog reset
--------------------------------------------------------------------------------
         0x0004  .... a895  wdr             ; watchdog reset
true  - > 0x0005  .... 8895  sleep           ; circuit sleep
--------------------------------------------------------------------------------
         0x0005  .... 8895  sleep           ; circuit sleep
true  - > 0x0006  .... 0000  nop             ; no operation
--------------------------------------------------------------------------------
         0x0006  .... 0000  nop             ; no operation
true  - > 0x0007  .... 0127  eor r16 , r17    ; r16 <- r16 ^ r17
--------------------------------------------------------------------------------
         0x0007  .... 0127  eor r16 , r17    ; r16 <- r16 ^ r17
--------------------------------------------------------------------------------
         0x3fff  .... 839a  sbi 0x10 , 3     ; IO[0x10, 3] <- 1
true  - > 0x0000  .... f1f3  breq - 2         ; (ZF == 1): PC <- PC + -2 + 1
--------------------------------------------------------------------------------

打印拆卸英特爾十六進製文件

 /* A possible implementation of print_instruction can be found below */

int main ( const int argc , const char * * argv ) {
    
    /* ignoring checks for this example */
    vmcu_model_t  * m328p  = vmcu_model_ctor ( VMCU_DEVICE_M328P ); 
    vmcu_report_t * report = vmcu_analyze_file ( "file.srec" , m328p );
    
    for ( uint32_t i = 0 ; i < report -> progsize ; i ++ ) {

        printf ( "0x%04x " , report -> disassembly [ i ]. addr );
        print_instruction ( & report -> disassembly [ i ]);
    }
        
    vmcu_report_dtor ( report );
    vmcu_model_dtor ( m328p );
    
    return EXIT_SUCCESS ;
}

 0x004e ldi r27 , 0x06 ; r27 <- 0x06
0x004f rjmp 1        ; PC <- PC + 1 + 1
0x0050 st X +, r1     ; DS[X+] <- r1
0x0051 cpi r26 , 0x20 ; r26 - 0x20
0x0052 cpc r27 , r18  ; r27 - r18 - CF
0x0053 brne - 4       ; (ZF == 0): PC <- PC + -4 + 1
0x0054 call 0x60b    ; PC <- 0x60b

在狀態標誌上過濾讀/寫入訪問

 /* A possible implementation of print_instruction can be found below */

int main ( const int argc , const char * * argv ) {

    /* ignoring checks for this example */
    vmcu_model_t  * m328p  = vmcu_model_ctor ( VMCU_DEVICE_M328P ); 
    vmcu_report_t * report = vmcu_analyze_file ( "file.hex" , m328p );

    for ( uint32_t i = 0 ; i < report -> progsize ; i ++ ) {

        vmcu_instr_t * instr = & report -> disassembly [ i ];
        
        if ( instr -> writes . c_flag == true)
            print_instruction ( instr );
        
        if ( instr -> reads . c_flag == true)
            print_instruction ( instr );
    }
    
    vmcu_report_dtor ( report );
    vmcu_model_dtor ( m328p );
    
    return EXIT_SUCCESS ;
}

 subi r18 , 0x00     ; r18 <- r18 - 0x00
adiw r29:r28 , 0x1a ; r29:r28 <- r29:r28 + 0x1a
sbci r23 , 0xff     ; r23 <- r23 - 0xff - CF
cpc r19 , r17       ; r19 - r17 - CF

打印中斷向量及其Xref-to

 int main ( const int argc , const char * * argv ) {

    /* ignoring checks for this example */
    vmcu_model_t  * m328p  = vmcu_model_ctor ( VMCU_DEVICE_M328P ); 
    vmcu_report_t * report = vmcu_analyze_file ( "file.hex" , m328p );

    for ( uint32_t i = 0 ; i < report -> n_vector ; i ++ ) {

        vmcu_vector_t * vect = & report -> vector [ i ];
        vmcu_instr_t  * isr  = vect -> xto -> i ;
        
        printf ( "Vector ID %d @ 0x%04xn" , vect -> id , vect -> addr );
        printf ( " interrupt service routine at 0x%04x" , isr -> addr );
        printf ( "nn" );
    }
    
    vmcu_report_dtor ( report );
    vmcu_model_dtor ( m328p );
    
    return EXIT_SUCCESS ;
}

 Vector ID 16 @ 0x0020
 interrupt service routine at 0x03f5

Vector ID 17 @ 0x0022
 interrupt service routine at 0x008a

Vector ID 18 @ 0x0024
 interrupt service routine at 0x03c3

Vector ID 19 @ 0x0026
 interrupt service routine at 0x039d

打印潛在標籤的Xref

 /* A possible implementation of print_instruction can be found below */

int main ( const int argc , const char * * argv ) {
    
    /* ignoring checks for this example */
    vmcu_model_t  * m328p  = vmcu_model_ctor ( VMCU_DEVICE_M328P ); 
    vmcu_report_t * report = vmcu_analyze_file ( "file.hex" , m328p );
    
    for ( uint32_t i = 0 ; i < report -> n_label ; i ++ ) {

        vmcu_label_t * lx = & report -> label [ i ];
        printf ( "0x%04xtL%dnn" , lx -> addr , lx -> id );

        for ( uint32_t j = 0 ; j < lx -> n_xfrom ; j ++ ) {

            vmcu_xref_t * x = & lx -> xfrom [ j ];
            
            printf ( " xref from 0x%04x " , x -> i -> addr );
            print_instruction ( x -> i );
        }

        printf ( "n" );
    }
    
    vmcu_report_dtor ( report );
    vmcu_model_dtor ( m328p );
    
    return EXIT_SUCCESS ;
}

 0x04c6  L75

 xref from 0x04a1 call + 1222 ; PC <- 0x4c6
 xref from 0x0a84 call + 1222 ; PC <- 0x4c6
 xref from 0x0b5c call + 1222 ; PC <- 0x4c6

0x04e2  L76

 xref from 0x05d4 rjmp - 243  ; PC <- PC - 0xf3 + 1

0x05d0  L77

 xref from 0x04e1 rjmp + 238  ; PC <- PC + 0xee + 1

打印特殊功能寄存器的XREF

 /* A possible implementation of print_instruction can be found below */

int main ( const int argc , const char * * argv ) {

    /* ignoring checks for this example */
    vmcu_model_t  * m328p  = vmcu_model_ctor ( VMCU_DEVICE_M328P ); 
    vmcu_report_t * report = vmcu_analyze_file ( "file.hex" , m328p );

    for ( uint32_t i = 0 ; i < report -> n_sfr ; i ++ ) {

        vmcu_sfr_t * sfr = & report -> sfr [ i ];
        printf ( "SFR ID: %dnn" , sfr -> id );

        for ( uint32_t j = 0 ; j < sfr -> n_xfrom ; j ++ ) {

            vmcu_xref_t * x = & sfr -> xfrom [ j ];

            printf ( " xref from 0x%04x " , x -> i -> addr );
            print_instruction ( x -> i );
        }

        printf ( "n" );
    }

    vmcu_report_dtor ( report );
    vmcu_model_dtor ( m328p );
    
    return EXIT_SUCCESS ;
}

 SFR ID: 17
       
 xref from 0x00f4 sbi 0x1f , 2     ; IO[1f, 2] <- 0x01
 xref from 0x00f5 sbi 0x1f , 1     ; IO[1f, 1] <- 0x01
 
SFR ID: 50

 xref from 0x004c sts 0x006e , r1  ; DATA[0x6e] <- R1
 xref from 0x0051 lds r24 , 0x006e ; R24 <- DATA[0x6e]
 xref from 0x0054 sts 0x006e , r24 ; DATA[0x6e] <- R24

從OpCode提取詳細信息

 /* 0x6a97 (little endian) <=> sbiw r29:r28, 0x1a */

int main ( const int argc , const char * * argv ) {
    
    /* initialize a device model */
    vmcu_model_t * m328p = vmcu_model_ctor ( VMCU_DEVICE_M328P );
    
    vmcu_instr_t instr ;
    vmcu_disassemble_bytes ( 0x6a97 , & instr , m328p );
    
    const VMCU_IKEY key    = instr . key ;           // VMCU_IKEY_SBIW
    const VMCU_GROUP grp   = instr . group ;         // VMCU_GROUP_MATH_LOGIC
    
    const uint32_t opcode  = instr . opcode ;        // 0x976a (big endian)
    const uint32_t addr    = instr . addr ;          // 0x0000 (undefined)

    const bool dword       = instr . dword ;         // false
    const bool exec        = instr . exec ;          // true
    
    vmcu_operand_t * src    = & instr . src ;          // source operand
    vmcu_operand_t * dest   = & instr . dest ;         // destination operand

    VMCU_OPTYPE src_type   = src -> type ;           // VMCU_OPTYPE_K6
    VMCU_OPTYPE dest_type  = dest -> type ;          // VMCU_OPTYPE_RP
    
    const uint8_t src_val  = src -> k ;              // 0x1a
    
    VMCU_REGISTER dest_rh  = dest -> rp . high ;       // VMCU_REGISTER_R29
    VMCU_REGISTER dest_rl  = dest -> rp . low ;        // VMCU_REGISTER_R28
    
    const bool writes_hf   = instr . writes . h_flag ; // false
    const bool writes_cf   = instr . writes . c_flag ; // true
    
    const bool reads_io    = instr . reads . io ;      // false
    const bool reads_nf    = instr . reads . n_flag ;  // false
    
    vmcu_mnemonic_t * mnem  = & instr . mnem ;         // instruction mnemonic
    
    const char * base_str   = mnem -> base ;          // "sbiw"
    const char * dest_str   = mnem -> dest ;          // "r29:r28"
    const char * src_str    = mnem -> src ;           // "0x1a"
    const char * com_str    = mnem -> comment ;       // "r29:r28 <- r29:r28 - 0x1a"
    
    vmcu_model_dtor ( m328p );
    
    return EXIT_SUCCESS ;
}

指令式函數的示例

 /* this snippet can be used to assemble and print an instruction */

void print_instruction ( const vmcu_instr_t * instr ) {

    printf ( "%s" ,  instr -> mnem . base );

    if ( instr -> dest . type != VMCU_OPTYPE_NONE )
        printf ( " %s," , instr -> mnem . dest );

    if ( instr -> src . type != VMCU_OPTYPE_NONE )
        printf ( " %s" , instr -> mnem . src );

    printf ( " %sn" , instr -> mnem . comment );
}

展示櫃

mdx_debug ^{用libvmcu編寫的小型調試器}

設定

目前，該庫帶有兩個標頭，兩個都可以在Engine/include/libvmcu中找到：

libvmcu_analyzer.h（靜態分析）
libvmcu_system.h（動態分析，仿真）

假設我們在此存儲庫的最高級別上有一個名為prog.c的文件，我們想將其鏈接到libvmcu：

包括LIBVMCU標題

 /* prog.c */

#include "libvmcu_analyzer.h"
#include "libvmcu_system.h"

int main ( void ) {
    
    /* do something */
    return 0 ;
}

構建libvmcu

 You@Terminal:~ $ cd build-release/
You@Terminal:~ $ make -f build.mk

構建驅動程序對象

 You@Terminal:~ $ gcc -Iengine/include/libvmcu/ -c prog.c -o prog.o

與libvmcu鏈接（不要忘記-LM）

 You@Terminal:~ $ gcc -o prog prog.o -Lbuild-release/ -lvmcu -lm

就是這樣。如果您面臨問題，請查看駕駛員/目錄中的一些示例。

支持的微控制器

LIBVMCU試圖支持盡可能多的AVR類型進行靜態分析。目前，動態分析僅針對Atmega328家族進行，但將來可能會擴展。

在靜態分析中添加新的微控制器應該很容易。有關更多信息，請查看引擎/*/Arch/

支持MCUS進行靜態分析

支持的MCU進行動態分析

atmega328（p）
Atmega168
atmega88
Atmega48

靜態分析

動態分析

指示

當前VMCU支持：〜133個說明。因此，一些說明被用作“ NOP”指令，因此沒有真正的功能。這些說明將盡快實施。按照說明需要進一步的工作：

WDR
ELPM
des
睡覺
SPM
休息

所有其他大會說明都很好。

綁定

爪哇
Python

libvmcu具有用於基本功能的Java結合。有關更多信息，請查看Bindings/Java/

另請注意，由於引擎的開發，綁定可能並不總是與最新版本一起使用。

貢獻

引擎	司機	綁定	測試
關閉PR	開放PR	開放PR	開放PR

學分

非常感謝亞歷山大·漢森（Alexander Hansen）的新徽標和建築圖。 :)

文件

到撰寫本文時，文檔仍在開發中。可以在https://github.com/milo-d/libvmcu-virtual-mcu-library/wiki上找到（不完整的）文檔

如果您缺少信息，並且不想等待Wiki，則LIBVMCU標頭文件也有很好的記錄。