WinPcap  4.1.3
Data Structures | Macros | Typedefs
NPF Just-in-time compiler definitions

Data Structures

struct  binary_stream
 A stream of X86 binary code. More...
 
struct  JIT_BPF_Filter
 Structure describing a x86 filtering program created by the jitter. More...
 

Macros

#define EAX   0
 
#define ECX   1
 
#define EDX   2
 
#define EBX   3
 
#define ESP   4
 
#define EBP   5
 
#define ESI   6
 
#define EDI   7
 
#define AX   0
 
#define CX   1
 
#define DX   2
 
#define BX   3
 
#define SP   4
 
#define BP   5
 
#define SI   6
 
#define DI   7
 
#define AL   0
 
#define CL   1
 
#define DL   2
 
#define BL   3
 
#define MOVid(r32, i32)   emitm(&stream, 11 << 4 | 1 << 3 | r32 & 0x7, 1); emitm(&stream, i32, 4);
 mov r32,i32 More...
 
#define MOVrd(dr32, sr32)   emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);
 mov dr32,sr32 More...
 
#define MOVodd(dr32, sr32, off)
 mov dr32,sr32[off] More...
 
#define MOVobd(dr32, sr32, or32)
 mov dr32,sr32[or32] More...
 
#define MOVobw(dr32, sr32, or32)
 mov dr16,sr32[or32] More...
 
#define MOVobb(dr8, sr32, or32)
 mov dr8,sr32[or32] More...
 
#define MOVomd(dr32, or32, sr32)
 mov [dr32][or32],sr32 More...
 
#define BSWAP(dr32)
 bswap dr32 More...
 
#define SWAP_AX()
 xchg al,ah More...
 
#define PUSH(r32)   emitm(&stream, 5 << 4 | 0 << 3 | r32 & 0x7, 1);
 push r32 More...
 
#define POP(r32)   emitm(&stream, 5 << 4 | 1 << 3 | r32 & 0x7, 1);
 pop r32 More...
 
#define RET()   emitm(&stream, 12 << 4 | 0 << 3 | 3, 1);
 ret More...
 
#define ADDrd(dr32, sr32)
 add dr32,sr32 More...
 
#define ADD_EAXi(i32)
 add eax,i32 More...
 
#define ADDid(r32, i32)
 add r32,i32 More...
 
#define ADDib(r32, i8)
 add r32,i8 More...
 
#define SUBrd(dr32, sr32)
 sub dr32,sr32 More...
 
#define SUB_EAXi(i32)
 sub eax,i32 More...
 
#define MULrd(r32)
 mul r32 More...
 
#define DIVrd(r32)
 div r32 More...
 
#define ANDib(r8, i8)
 and r8,i8 More...
 
#define ANDid(r32, i32)
 and r32,i32 More...
 
#define ANDrd(dr32, sr32)
 and dr32,sr32 More...
 
#define ORrd(dr32, sr32)
 or dr32,sr32 More...
 
#define ORid(r32, i32)
 or r32,i32 More...
 
#define SHLib(r32, i8)
 shl r32,i8 More...
 
#define SHL_CLrb(dr32)
 shl dr32,cl More...
 
#define SHRib(r32, i8)
 shr r32,i8 More...
 
#define SHR_CLrb(dr32)
 shr dr32,cl More...
 
#define NEGd(r32)
 neg r32 More...
 
#define CMPodd(dr32, sr32, off)
 cmp dr32,sr32[off] More...
 
#define CMPrd(dr32, sr32)
 cmp dr32,sr32 More...
 
#define CMPid(dr32, i32)
 cmp dr32,i32 More...
 
#define JNEb(off8)
 jne off32 More...
 
#define JAb(off8)
 ja off32 More...
 
#define JE(off32)
 je off32 More...
 
#define JLE(off32)
 jle off32 More...
 
#define JLEb(off8)
 jle off8 More...
 
#define JBEb(off8)
 jbe off8 More...
 
#define JBb(off8)
 jb off8 More...
 
#define JA(off32)
 ja off32 More...
 
#define JAE(off32)
 jae off32 More...
 
#define JG(off32)
 jg off32 More...
 
#define JGE(off32)
 jge off32 More...
 
#define JMP(off32)
 jmp off32 More...
 

Typedefs

typedef struct binary_stream binary_stream
 A stream of X86 binary code. More...
 
typedef UINT(__cdecl * BPF_filter_function) (PVOID *, ULONG, UINT)
 Prototype of a filtering function created by the jitter. More...
 
typedef void(* emit_func) (binary_stream *stream, ULONG value, UINT n)
 Prototype of the emit functions. More...
 
typedef struct JIT_BPF_Filter JIT_BPF_Filter
 Structure describing a x86 filtering program created by the jitter. More...
 

Detailed Description

Macro Definition Documentation

◆ ADD_EAXi

#define ADD_EAXi (   i32)
Value:
emitm(&stream, 0x05, 1);\
emitm(&stream, i32, 4);

add eax,i32

Definition at line 176 of file jitter.h.

◆ ADDib

#define ADDib (   r32,
  i8 
)
Value:
emitm(&stream, 0x83, 1);\
emitm(&stream, 24 << 3 | r32, 1);\
emitm(&stream, i8, 1);

add r32,i8

Definition at line 187 of file jitter.h.

◆ ADDid

#define ADDid (   r32,
  i32 
)
Value:
emitm(&stream, 0x81, 1);\
emitm(&stream, 24 << 3 | r32, 1);\
emitm(&stream, i32, 4);

add r32,i32

Definition at line 181 of file jitter.h.

◆ ADDrd

#define ADDrd (   dr32,
  sr32 
)
Value:
emitm(&stream, 0x03, 1);\
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | (sr32 & 0x7), 1);

add dr32,sr32

Definition at line 171 of file jitter.h.

◆ AL

#define AL   0

Definition at line 64 of file jitter.h.

◆ ANDib

#define ANDib (   r8,
  i8 
)
Value:
emitm(&stream, 0x80, 1);\
emitm(&stream, 7 << 5 | r8, 1);\
emitm(&stream, i8, 1);

and r8,i8

Definition at line 213 of file jitter.h.

◆ ANDid

#define ANDid (   r32,
  i32 
)
Value:
if (r32 == EAX){ \
emitm(&stream, 0x25, 1);\
emitm(&stream, i32, 4);}\
else{ \
emitm(&stream, 0x81, 1);\
emitm(&stream, 7 << 5 | r32, 1);\
emitm(&stream, i32, 4);}

and r32,i32

Definition at line 219 of file jitter.h.

◆ ANDrd

#define ANDrd (   dr32,
  sr32 
)
Value:
emitm(&stream, 0x23, 1);\
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);

and dr32,sr32

Definition at line 229 of file jitter.h.

◆ AX

#define AX   0

Definition at line 55 of file jitter.h.

◆ BL

#define BL   3

Definition at line 67 of file jitter.h.

◆ BP

#define BP   5

Definition at line 60 of file jitter.h.

◆ BSWAP

#define BSWAP (   dr32)
Value:
emitm(&stream, 0xf, 1); \
emitm(&stream, 0x19 << 3 | dr32 , 1);

bswap dr32

Definition at line 149 of file jitter.h.

◆ BX

#define BX   3

Definition at line 58 of file jitter.h.

◆ CL

#define CL   1

Definition at line 65 of file jitter.h.

◆ CMPid

#define CMPid (   dr32,
  i32 
)
Value:
if (dr32 == EAX){ \
emitm(&stream, 0x3d, 1); \
emitm(&stream, i32, 4);} \
else{ \
emitm(&stream, 0x81, 1); \
emitm(&stream, 0x1f << 3 | (dr32 & 0x7), 1);\
emitm(&stream, i32, 4);}

cmp dr32,i32

Definition at line 287 of file jitter.h.

◆ CMPodd

#define CMPodd (   dr32,
  sr32,
  off 
)
Value:
emitm(&stream, 3 << 4 | 3 | 1 << 3, 1); \
emitm(&stream, 1 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);\
emitm(&stream, off, 1);

cmp dr32,sr32[off]

Definition at line 276 of file jitter.h.

◆ CMPrd

#define CMPrd (   dr32,
  sr32 
)
Value:
emitm(&stream, 0x3b, 1); \
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);

cmp dr32,sr32

Definition at line 282 of file jitter.h.

◆ CX

#define CX   1

Definition at line 56 of file jitter.h.

◆ DI

#define DI   7

Definition at line 62 of file jitter.h.

◆ DIVrd

#define DIVrd (   r32)
Value:
emitm(&stream, 0xf7, 1);\
emitm(&stream, 15 << 4 | (r32 & 0x7), 1);

div r32

Definition at line 208 of file jitter.h.

◆ DL

#define DL   2

Definition at line 66 of file jitter.h.

◆ DX

#define DX   2

Definition at line 57 of file jitter.h.

◆ EAX

#define EAX   0

Definition at line 46 of file jitter.h.

◆ EBP

#define EBP   5

Definition at line 51 of file jitter.h.

◆ EBX

#define EBX   3

Definition at line 49 of file jitter.h.

◆ ECX

#define ECX   1

Definition at line 47 of file jitter.h.

◆ EDI

#define EDI   7

Definition at line 53 of file jitter.h.

◆ EDX

#define EDX   2

Definition at line 48 of file jitter.h.

◆ ESI

#define ESI   6

Definition at line 52 of file jitter.h.

◆ ESP

#define ESP   4

Definition at line 50 of file jitter.h.

◆ JA

#define JA (   off32)
Value:
emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x87, 1);\
emitm(&stream, off32, 4);

ja off32

Definition at line 334 of file jitter.h.

◆ JAb

#define JAb (   off8)
Value:
emitm(&stream, 0x77, 1);\
emitm(&stream, off8, 1);

ja off32

Definition at line 302 of file jitter.h.

◆ JAE

#define JAE (   off32)
Value:
emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x83, 1);\
emitm(&stream, off32, 4);

jae off32

Definition at line 340 of file jitter.h.

◆ JBb

#define JBb (   off8)
Value:
emitm(&stream, 0x72, 1);\
emitm(&stream, off8, 1);

jb off8

Definition at line 329 of file jitter.h.

◆ JBEb

#define JBEb (   off8)
Value:
emitm(&stream, 0x76, 1);\
emitm(&stream, off8, 1);

jbe off8

Definition at line 324 of file jitter.h.

◆ JE

#define JE (   off32)
Value:
emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x84, 1);\
emitm(&stream, off32, 4);

je off32

Definition at line 307 of file jitter.h.

◆ JG

#define JG (   off32)
Value:
emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x8f, 1);\
emitm(&stream, off32, 4);

jg off32

Definition at line 346 of file jitter.h.

◆ JGE

#define JGE (   off32)
Value:
emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x8d, 1);\
emitm(&stream, off32, 4);

jge off32

Definition at line 352 of file jitter.h.

◆ JLE

#define JLE (   off32)
Value:
emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x8e, 1);\
emitm(&stream, off32, 4);

jle off32

Definition at line 313 of file jitter.h.

◆ JLEb

#define JLEb (   off8)
Value:
emitm(&stream, 0x7e, 1);\
emitm(&stream, off8, 1);

jle off8

Definition at line 319 of file jitter.h.

◆ JMP

#define JMP (   off32)
Value:
emitm(&stream, 0xe9, 1);\
emitm(&stream, off32, 4);

jmp off32

Definition at line 358 of file jitter.h.

◆ JNEb

#define JNEb (   off8)
Value:
emitm(&stream, 0x75, 1);\
emitm(&stream, off8, 1);

jne off32

Definition at line 297 of file jitter.h.

◆ MOVid

#define MOVid (   r32,
  i32 
)    emitm(&stream, 11 << 4 | 1 << 3 | r32 & 0x7, 1); emitm(&stream, i32, 4);

mov r32,i32

Definition at line 110 of file jitter.h.

◆ MOVobb

#define MOVobb (   dr8,
  sr32,
  or32 
)
Value:
emitm(&stream, 0x8a, 1); \
emitm(&stream, (dr8 & 0x7) << 3 | 4 , 1);\
emitm(&stream, (or32 & 0x7) << 3 | (sr32 & 0x7) , 1);

mov dr8,sr32[or32]

Definition at line 137 of file jitter.h.

◆ MOVobd

#define MOVobd (   dr32,
  sr32,
  or32 
)
Value:
emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \
emitm(&stream, (dr32 & 0x7) << 3 | 4 , 1);\
emitm(&stream, (or32 & 0x7) << 3 | (sr32 & 0x7) , 1);

mov dr32,sr32[or32]

Definition at line 124 of file jitter.h.

◆ MOVobw

#define MOVobw (   dr32,
  sr32,
  or32 
)
Value:
emitm(&stream, 0x66, 1); \
emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \
emitm(&stream, (dr32 & 0x7) << 3 | 4 , 1);\
emitm(&stream, (or32 & 0x7) << 3 | (sr32 & 0x7) , 1);

mov dr16,sr32[or32]

Definition at line 130 of file jitter.h.

◆ MOVodd

#define MOVodd (   dr32,
  sr32,
  off 
)
Value:
emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \
emitm(&stream, 1 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);\
emitm(&stream, off, 1);

mov dr32,sr32[off]

Definition at line 118 of file jitter.h.

◆ MOVomd

#define MOVomd (   dr32,
  or32,
  sr32 
)
Value:
emitm(&stream, 0x89, 1); \
emitm(&stream, (sr32 & 0x7) << 3 | 4 , 1);\
emitm(&stream, (or32 & 0x7) << 3 | (dr32 & 0x7) , 1);

mov [dr32][or32],sr32

Definition at line 143 of file jitter.h.

◆ MOVrd

#define MOVrd (   dr32,
  sr32 
)    emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);

mov dr32,sr32

Definition at line 114 of file jitter.h.

◆ MULrd

#define MULrd (   r32)
Value:
emitm(&stream, 0xf7, 1);\
emitm(&stream, 7 << 5 | (r32 & 0x7), 1);

mul r32

Definition at line 203 of file jitter.h.

◆ NEGd

#define NEGd (   r32)
Value:
emitm(&stream, 0xf7, 1);\
emitm(&stream, 27 << 3 | r32 & 0x7, 1);

neg r32

Definition at line 271 of file jitter.h.

◆ ORid

#define ORid (   r32,
  i32 
)
Value:
if (r32 == EAX){ \
emitm(&stream, 0x0d, 1);\
emitm(&stream, i32, 4);}\
else{ \
emitm(&stream, 0x81, 1);\
emitm(&stream, 25 << 3 | r32, 1);\
emitm(&stream, i32, 4);}

or r32,i32

Definition at line 239 of file jitter.h.

◆ ORrd

#define ORrd (   dr32,
  sr32 
)
Value:
emitm(&stream, 0x0b, 1);\
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);

or dr32,sr32

Definition at line 234 of file jitter.h.

◆ POP

#define POP (   r32)    emitm(&stream, 5 << 4 | 1 << 3 | r32 & 0x7, 1);

pop r32

Definition at line 163 of file jitter.h.

◆ PUSH

#define PUSH (   r32)    emitm(&stream, 5 << 4 | 0 << 3 | r32 & 0x7, 1);

push r32

Definition at line 159 of file jitter.h.

◆ RET

#define RET ( )    emitm(&stream, 12 << 4 | 0 << 3 | 3, 1);

ret

Definition at line 167 of file jitter.h.

◆ SHL_CLrb

#define SHL_CLrb (   dr32)
Value:
emitm(&stream, 0xd3, 1);\
emitm(&stream, 7 << 5 | dr32 & 0x7, 1);

shl dr32,cl

Definition at line 255 of file jitter.h.

◆ SHLib

#define SHLib (   r32,
  i8 
)
Value:
emitm(&stream, 0xc1, 1);\
emitm(&stream, 7 << 5 | r32 & 0x7, 1);\
emitm(&stream, i8, 1);

shl r32,i8

Definition at line 249 of file jitter.h.

◆ SHR_CLrb

#define SHR_CLrb (   dr32)
Value:
emitm(&stream, 0xd3, 1);\
emitm(&stream, 29 << 3 | dr32 & 0x7, 1);

shr dr32,cl

Definition at line 266 of file jitter.h.

◆ SHRib

#define SHRib (   r32,
  i8 
)
Value:
emitm(&stream, 0xc1, 1);\
emitm(&stream, 29 << 3 | r32 & 0x7, 1);\
emitm(&stream, i8, 1);

shr r32,i8

Definition at line 260 of file jitter.h.

◆ SI

#define SI   6

Definition at line 61 of file jitter.h.

◆ SP

#define SP   4

Definition at line 59 of file jitter.h.

◆ SUB_EAXi

#define SUB_EAXi (   i32)
Value:
emitm(&stream, 0x2d, 1);\
emitm(&stream, i32, 4);

sub eax,i32

Definition at line 198 of file jitter.h.

◆ SUBrd

#define SUBrd (   dr32,
  sr32 
)
Value:
emitm(&stream, 0x2b, 1);\
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | (sr32 & 0x7), 1);

sub dr32,sr32

Definition at line 193 of file jitter.h.

◆ SWAP_AX

#define SWAP_AX ( )
Value:
emitm(&stream, 0x86, 1); \
emitm(&stream, 0xc4 , 1);

xchg al,ah

Definition at line 154 of file jitter.h.

Typedef Documentation

◆ binary_stream

typedef struct binary_stream binary_stream

A stream of X86 binary code.

◆ BPF_filter_function

typedef UINT(__cdecl * BPF_filter_function) (PVOID *, ULONG, UINT)

Prototype of a filtering function created by the jitter.

The syntax and the meaning of the parameters is analogous to the one of bpf_filter(). Notice that the filter is not among the parameters, because it is hardwired in the function.

Definition at line 82 of file jitter.h.

◆ emit_func

typedef void(* emit_func) (binary_stream *stream, ULONG value, UINT n)

Prototype of the emit functions.

Different emit functions are used to create the reference table and to generate the actual filtering code. This allows to have simpler instruction macros. The first parameter is the stream that will receive the data. The secon one is a variable containing the data, the third one is the length, that can be 1,2 or 4 since it is possible to emit a byte, a short or a work at a time.

Definition at line 92 of file jitter.h.

◆ JIT_BPF_Filter

Structure describing a x86 filtering program created by the jitter.

EAX
#define EAX
Definition: jitter.h:45

documentation. Copyright (c) 2002-2005 Politecnico di Torino. Copyright (c) 2005-2010 CACE Technologies. Copyright (c) 2010-2013 Riverbed Technology. All rights reserved.