3
:�)g�P � @ s� d dl mZ d dlZddlmZ G dd� dej�ZG dd� dej�ZG d d
� d
ej �Z
G d d � d ej�Z G d
d� d�Z ddd�Z
dd� Zdd� ZG dd� d�Zddd�ZdS ) � )�linesepN� )�get_table_type_namec @ s e Zd ZdejfdejfgZdS )� OffsetUnionZoffsetu�offsetN)�__name__�
__module__� __qualname__�ctZc_uint16Zc_int16�_fields_� r r �"/usr/lib/python3.6/disassembler.pyr s r c @ s e Zd ZdejfdejfgZdS )�ImmUnion�immu�immN)r r r r
Zc_uint32Zc_int32r r r r r
r s r c @ s@ e Zd ZdZd ZdejfdejdfdejdfdefdefgZ dS )
�BPFInstrFieldsr �o�i�opcode�dst� �srcN)r r )
r r r �_pack_� _anonymous_r
Zc_uint8r r r r r r r
r s
r c @ s& e Zd ZdZdZdefdejfgZdS )�BPFInstrr �s�instrN) r r r r r r r
�c_uint64r r r r r
r " s r c d @ s� e Zd ZdZdddddddd d
d d d
ddddddddddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^g]Zd�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d��d �d�d�d�d�d�d�d�d�d �d
�d �d �d
�d�d�d�d�d�d�d�d�d�d�d�d�d�d�d �d �d �d �d �d!�d"�d#�d$�d%�d&�d'�d(�d)�d*dǜaZed�dɄ �ZdeS (+ �
BPFDecoderr ZunspecZmap_lookup_elemZmap_update_elemZmap_delete_elemZ
probe_readZ ktime_get_nsZ trace_printkZget_prandom_u32Zget_smp_processor_idZskb_store_bytesZl3_csum_replaceZl4_csum_replaceZ tail_callZclone_redirectZget_current_pid_tgidZget_current_uid_gidZget_current_commZget_cgroup_classidZ
skb_vlan_pushZ skb_vlan_popZskb_get_tunnel_keyZskb_set_tunnel_keyZperf_event_readZredirectZget_route_realmZperf_event_outputZskb_load_bytesZ get_stackidZ csum_diffZskb_get_tunnel_optZskb_set_tunnel_optZskb_change_protoZskb_change_typeZskb_under_cgroupZget_hash_recalcZget_current_taskZprobe_write_userZcurrent_task_under_cgroupZskb_change_tailZ
skb_pull_dataZ csum_updateZset_hash_invalidZget_numa_node_idZskb_change_headZxdp_adjust_headZprobe_read_strZget_socket_cookieZget_socket_uidZset_hashZ
setsockoptZskb_adjust_roomZ redirect_mapZsk_redirect_mapZsock_map_updateZxdp_adjust_metaZperf_event_read_valueZperf_prog_read_valueZ
getsockoptZoverride_returnZsock_ops_cb_flags_setZmsg_redirect_mapZmsg_apply_bytesZmsg_cork_bytesZ
msg_pull_dataZbindZxdp_adjust_tailZskb_get_xfrm_stateZ get_stackZskb_load_bytes_relativeZ
fib_lookupZsock_hash_updateZmsg_redirect_hashZsk_redirect_hashZlwt_push_encapZlwt_seg6_store_bytesZlwt_seg6_adjust_srhZlwt_seg6_actionZ rc_repeatZ
rc_keydownZ
skb_cgroup_idZget_current_cgroup_idZget_local_storageZsk_select_reuseportZskb_ancestor_cgroup_idZ
sk_lookup_tcpZ
sk_lookup_udpZ
sk_releaseZ
map_push_elemZ map_pop_elemZ
map_peek_elemZ
msg_push_dataZ msg_pop_dataZrc_pointer_rel�add32�dstimm�+=� �ja�joffN�@ �add�dstsrc�sub32�-=�jeq�
jdstimmoff�==�sub�lddw�
jdstsrcoff�ldabsw�ldabs�mul32�*=�jgt�>�mul�ldabsh� �ldabsb� �div32�/=�jge�>=�div�ldabsdw�ldindw�ldind�or32� dstimm_bw�|=�jset�&�or�ldindh�ldindb�and32�&=�jne�!=�and�ldinddw�ldxw�
ldstsrcoff�stw�
sdstoffimm�stxw�
sdstoffsrc�lsh32�<<=�jsgt�s>�lsh�ldxh�sth�stxh�ldxb�stb�stxb�rsh32�>>=�jsge�s>=�rsh�ldxdw�stdw�stxdw�neg32r �~�call�neg�mod32�%=�exit�mod�xor32�^=�jlt�<�xor�mov32�=�jle�<=�mov�arsh32�s>>=�jslt�s<�arsh�jsle�s<=�endian32�endian)ar � � � � � � � � � � � r" �$ �% �' �( �, �- �/ �0 �4 �5 �7 �8 �< �= �? r% �D �E �G �H �L �M �O �P �T �U �W �X �\ �] �_ �a �b �c �d �e �g �i �j �k �l �m �o �q �r �s �t �u �w �y �z �{ �| �} � � � � � � � � � � � � � � � � � � � � � �� �� �� �� �� �� �� �� �� c C s� �y�| j |j \}}}}|dkr6d|j||jf dfS |dkrTd|j||jf dfS |dkr|dd|j ||j d f dfS |d
kr�d |j||jf dfS |d kr�d
|j||jd|j ||j d f dfS |dk�r d|j||jd|j ||j d f dfS |dk�r^|d k�r td��|jdk�r<d|j|jf d fS |jd> |jB }d|j|f d fS |dk�rzd||jf dfS |dk�r�d||jd|j f dfS |dk�r�d|j||jd|j f dfS |dk�r�d ||jd|j |jf dfS |d k�rd ||jd|j |jf dfS |d k�r8d |j|||jf dfS |d!k�r�|j| jk�r�y d"|| j |j |jf dfS t
k
�r� d#||jf dfS X d$|d|j f dfS |d%k�r�|dfS td&��W n t k
�r� d'|j S X d S )(Nr z r%d %s %dr rD z r%d %s 0x%xr$ z goto %s <%d>z%+dr r' z
r%d %s r%dr+ zif r%d %s %d goto pc%s <%d>r/ z if r%d %s r%d goto pc%s <%d>r. z1lddw requires two instructions to be disassembledzr%d = <map at fd #%d>r" z
r%d = 0x%xr1 zr0 = *(u%s*)skb[%s]rB zr0 = *(u%d*)skb[r%d %s]rR zr%d = *(u%d*)(r%d %s)rT z*(u%d*)(r%d %s) = %drV z*(u%d*)(r%d %s) = r%dr zr%d = %s (u%s)r%drl z %s bpf_%s#%dz%s <unknown helper #%d>z%s %srp zunknown opcode classzunknown <0x%x>) �opcodesr r r r r r � Exception�BPF_PSEUDO_CALL� bpf_helpers�
IndexError�KeyError) �clsr �w�w1�nameZopclass�op�bitsr r r r
�decode� sl
zBPFDecoder.decode)r r r! r" )r# r$ Nr% )r& r r! r% )r r' r! r" )r& r' r! r% )r( r r) r" )r* r+ r, r% )r- r r) r% )r. r. Nr% )r( r' r) r" )r* r/ r, r% )r- r' r) r% )r0 r1 Nr" )r2 r r3 r" )r4 r+ r5 r% )r6 r r3 r% )r7 r1 Nr8 )r2 r' r3 r" )r4 r/ r5 r% )r6 r' r3 r% )r9 r1 Nr: )r; r r< r" )r= r+ r> r% )r? r r< r% )r@ r1 Nr% )r; r' r< r" )r= r/ r> r% )r? r' r< r% )rA rB Nr" )rC rD rE r" )rF r+ rG r% )rH rD rE r% )rI rB Nr8 )rC r' rE r" )rF r/ rG r% )rH r' rE r% )rJ rB Nr: )rK rD rL r" )rM r+ rN r% )rO rD rL r% )rP rB Nr% )rK r' rL r" )rM r/ rN r% )rO r' rL r% )rQ rR Nr" )rS rT Nr" )rU rV Nr" )rW r rX r" )rY r+ rZ r% )r[ r rX r% )r\ rR Nr8 )r] rT Nr8 )r^ rV Nr8 )rW r' rX r" )rY r/ rZ r% )r[ r' rX r% )r_ rR Nr: )r` rT Nr: )ra rV Nr: )rb r rc r" )rd r+ re r% )rf r rc r% )rg rR Nr% )rh rT Nr% )ri rV Nr% )rb r' rc r" )rd r/ re r% )rf r' rc r% )rj r rk r" )rl rl Nr% )rm r rk r% )rn r ro r" )rp rp Nr% )rq r ro r% )rn r' ro r" )rq r' ro r% )rr rD rs r" )rt r+ ru r% )rv rD rs r% )rr r' rs r" )rt r/ ru r% )rv r' rs r% )rw r rx r" )ry r+ rz r% )r{ r rx r% )rw r' rx r" )ry r/ rz r% )r{ r' rx r% )r| r r} r" )r~ r+ r r% )r� r r} r% )r| r' r} r" )r~ r/ r r% )r� r' r} r% )r� r+ r� r% )r� r' r� r" )r� r+ r� r% )r r r r� r� r� � classmethodr� r r r r
r ' s�
r c C s& t j| ||�\}}d| |j|f |fS )Nz%4d: (%02x) %s)r r� r )r �w0r� r �skipr r r
�disassemble_instruction3 s r� c C s� t jt j| �t jt��}tt| �d �}|d }d}g }xRtd|�D ]D}|| }|rf|d8 }d| }nt|d ||�\}}|j |� |}qDW t|d |d �\}}|j |� |S )Nr: r r z %4d: (64-bit upper word))
r
�castZc_char_pZPOINTERr �int�len�ranger� �append) �bpfstrZptrZnuminstrr� r� �
instr_listr r� Z instr_strr r r
�disassemble_str7 s
r� c C s d| g}|t |�7 }tj|�S )Nz Disassemble of BPF program %s:)r� r �join)Z func_namer� r� r r r
�disassemble_progJ s
r� c " @ s� e Zd Zejdejdejdejdejdej dej
dej dej d ej
d
ejd ejd ejd
ejdejdejd dejd diZedd� �Zed!dd��Zed"dd ��Zed d � �Zed#d d ��ZdS )$�
MapDecoderZ_Bool�charZwchar_tz
unsigned charZshortzunsigned shortr� z unsigned intZlongz
unsigned longz long longzunsigned long long�floatZdoublez long double� Z__int128zunsigned __int128c C s� y^t |tj�rd}nHt |tj�r&d}n6t |tj�rR| j|j d t|j� d }n
| j| }W n t k
rz t|�}Y nX |S )N�struct�union�[�])
�
issubclassr
� Structure�UnionZArray� ctype2strZ_type_�strZ_length_r� )r� �t�field_type_namer r r
� get_ct_nameb s zMapDecoder.get_ct_nameFNc C s* |sdS |d k r d|||f S d||f S )N� z[%d,%d +%d bit]z [%d +%d] r )r� r �sizeZenabledZ bitoffsetr r r
�format_size_infoq s
zMapDecoder.format_size_infor r c C s� g }y�x�|j D ]�\}}t|tj�p,t|tj�}| j|�} t||�j}
tj|�} | j ||
| |�} |r�|j
d|| | f � || j ||d ||
�7 }|j
d||f � q|j
d|| | |f � qW W n� t k
�r� d}
x�|j D ]�}t
|�dk�r0|\}}}| j|�} | j ||
||�} |j
d|| | ||f � n`|\}}| j|�} t||�j}
tj|�} d}d}
| j ||
| |�} |j
d|| | |f � ||
7 }|
|7 }
q�W Y nX |S )Nz%s%s%s {z z%s} %s;z
%s%s%s %s;r � z
%s%s%s %s:%d;)r r r
r r r
�getattrr Zsizeofr r� � print_ct_map�
ValueErrorr� )r� r �indentr �sizeinfo� map_lines�
field_nameZ
field_type�
is_structuredr Z field_offsetZ
field_sizeZsizedescZ offset_bitsZfieldZ
field_bitsr r r
r y sZ
zMapDecoder.print_ct_mapc C sf t |tj�pt |tj�}| j|�}|rTd| g}|| j|d|d�7 }|jd| � nd||f g}|S )Nz %s {z )r z } %s;z %s %s;)r r
r r r
r r� )r� r r r r Z type_namer r r r
�print_map_ctype� s
zMapDecoder.print_map_ctypec C sL d|||j |jf g}|| j|jd|d�7 }|| j|jd|d�7 }tj|�S )Nz-Layout of BPF map %s (type %s, FD %d, ID %d):�key)r �value)Zmap_fdZmap_idr ZKeyZLeafr r� )r� �map_name�map_obj�map_typer r r r r
�
decode_map� s zMapDecoder.decode_map)FN)r r F)F) r r r r
Zc_boolZc_charZc_wcharZc_ubyteZc_shortZc_ushortZc_intZc_uintZc_longZc_ulongZ
c_longlongZ c_ulonglongZc_floatZc_doubleZ c_longdoubleZc_int64r r r� r
r r r r r r r r
r� O s2
3
r� Fc C s t |�}tj| |||d�S )N)r )r r� r )r r r r Z
map_type_namer r r
r � s r )N)F)�osr Zctypesr
�tabler r r r r r r r r� r� r� r� r r r r r
�<module> s
u