+/* code.c
+
+ Routines for handling Flash2 AVM2 ABC Actionscript
+
+ Extension module for the rfxswf library.
+ Part of the swftools package.
+
+ Copyright (c) 2008 Matthias Kramm <kramm@quiss.org>
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */
+
#include <assert.h>
#include "code.h"
#include "pool.h"
#define OP_LOOKUPSWITCH 512
#define OP_NEED_ACTIVATION 1024
#define OP_STACK_ARGS2 2048
+#define OP_INTERNAL 32768
/* 2 = u30 index into multiname
m = u30 index into method
n = u30 number of params
i = u30 index into method info
b = byte
- s = short
c = u30 index into class
s = string (u30 index into strings)
S = switch
u = u30
r = register
*/
-
+
opcode_t opcodes[]={
{0xa0, "add", "", -2, 1, 0, 0},
{0xc5, "add_i", "", -2, 1, 0, 0},
{0x29, "pop", "", -1, 0, 0, 0},
{0x1d, "popscope", "", 0, 0,-1, 0},
{0x24, "pushbyte", "b", 0, 1, 0, 0},
-{0x2f, "pushdouble", "u", 0, 1, 0, 0}, //index into floats
+{0x2f, "pushdouble", "f", 0, 1, 0, 0}, //index into floats
{0x27, "pushfalse", "", 0, 1, 0, 0},
-{0x2d, "pushint", "u", 0, 1, 0, 0}, //index into ints
-{0x31, "pushnamespace", "u", 0, 1, 0, 0}, //index into namespace
+{0x2d, "pushint", "I", 0, 1, 0, 0}, //index into ints
+{0x31, "pushnamespace", "u", 0, 1, 0, 0}, //index into namespace TODO
{0x28, "pushnan", "", 0, 1, 0, 0},
{0x20, "pushnull", "", 0, 1, 0, 0},
{0x30, "pushscope", "", -1, 0, 1, 0},
{0x25, "pushshort", "u", 0, 1, 0, 0},
{0x2c, "pushstring", "s", 0, 1, 0, 0},
{0x26, "pushtrue", "", 0, 1, 0, 0},
-{0x2e, "pushuint", "u", 0, 1, 0, 0}, //index into uints
+{0x2e, "pushuint", "U", 0, 1, 0, 0}, //index into uints
{0x21, "pushundefined", "", 0, 1, 0, 0},
{0x1c, "pushwith", "", -1, 0, 1, 0},
{0x48, "returnvalue", "", -1, 0, 0, OP_RETURN},
{0xd7, "setlocal_3", "", -1, 0, 0, OP_REGISTER},
{0x6f, "setglobalslot", "u", -1, 0, 0, 0},
{0x61, "setproperty", "2", -2, 0, 0, OP_STACK_NS},
-{0x6d, "setslot", "2", -2, 0, 0, 0},
+{0x6d, "setslot", "u", -2, 0, 0, 0},
{0x05, "setsuper", "2", -2, 0, 0, OP_STACK_NS},
{0xac, "strictequals", "", -2, 1, 0, 0},
{0xa1, "subtract", "", -2, 1, 0, 0},
{0x03, "throw", "", -1, 0, 0, OP_THROW},
{0x95, "typeof", "", -1, 1, 0, 0},
{0xa7, "urshift", "", -2, 1, 0, 0},
+
+/* opcodes not documented, but seen in the wild */
+//0x53: seen in builtin.abc
+{0x53, "applytype", "n", -1, 1, 0, OP_STACK_ARGS},
+
+/* dummy instructions. Warning: these are not actually supported by flash */
+{0xfd, "__fallthrough__", "s", 0, 0, 0, OP_INTERNAL},
+{0xfe, "__continue__", "s", 0, 0, 0, OP_RETURN|OP_INTERNAL},
+{0xff, "__break__", "s", 0, 0, 0, OP_RETURN|OP_INTERNAL},
};
static U8 op2index[256] = {254};
opcode_t*op = opcode_get(opcode);
if(!op) {
fprintf(stderr, "Can't parse opcode %02x\n", opcode);
- return head;
+ continue;
}
//printf("%s\n", op->name);fflush(stdout);
NEW(code_t,c);
data = (void*)(ptroff_t)swf_GetU30(tag);
} else if(*p == '2') { //multiname
data = multiname_clone(pool_lookup_multiname(pool, swf_GetU30(tag)));
+ } else if(*p == 'U') { //uint
+ data = (void*)(ptroff_t)pool_lookup_uint(pool, swf_GetU30(tag));
+ } else if(*p == 'I') { //int
+ data = (void*)(ptroff_t)pool_lookup_int(pool, swf_GetU30(tag));
+ } else if(*p == 'f') { //int
+ double*fp = malloc(sizeof(double));
+ *fp = pool_lookup_float(pool, swf_GetU30(tag));
+ data = fp;
} else if(*p == 'm') { //method
data = array_getvalue(file->methods, swf_GetU30(tag));
} else if(*p == 'c') { //classinfo
int j = swf_GetS24(tag);
data = (void*)(ptroff_t)j;
} else if(*p == 's') { // string
- data = strdup((char*)pool_lookup_string(pool, swf_GetU30(tag)));
+ string_t s = pool_lookup_string2(pool, swf_GetU30(tag));
+ data = string_dup3(&s);
} else if(*p == 'D') { // debug
/*type, usually 1*/
U8 type = swf_GetU8(tag);
code_t*code_find_start(code_t*c)
{
- while(c->prev)
+ while(c && c->prev)
c=c->prev;
return c;
}
void*data = c->data[pos];
if(*p == '2') { //multiname
multiname_destroy(data);
- } else if(strchr("sD", *p)) {
+ } else if(strchr("sDf", *p)) {
free(data);
} else if(strchr("S", *p)) {
lookupswitch_t*l = (lookupswitch_t*)data;
char*p = op->params;
int pos = 0;
int len = 0;
-
+
if(tag)
swf_SetU8(tag, c->opcode);
len++;
+ if(op->flags & OP_INTERNAL) {
+ if(c->opcode == OPCODE___BREAK__ ||
+ c->opcode == OPCODE___CONTINUE__) {
+ fprintf(stderr, "Unresolved %s\n", op->name);
+ } else {
+ fprintf(stderr, "Error: writing undefined internal opcode %s\n", op->name);
+ }
+ }
+
while(*p) {
void*data = c->data[pos++];
assert(pos<=2);
} else if(*p == 'i') { //methodbody
abc_method_body_t*m = (abc_method_body_t*)data;
len += swf_SetU30(tag, m->index);
+ } else if(*p == 'I') { // int
+ len += swf_SetU30(tag, pool_register_int(pool, (ptroff_t)data));
+ } else if(*p == 'U') { // uint
+ len += swf_SetU30(tag, pool_register_uint(pool, (ptroff_t)data));
+ } else if(*p == 'f') { // float
+ len += swf_SetU30(tag, pool_register_float(pool, *(double*)data));
} else if(*p == 'u') { // integer
len += swf_SetU30(tag, (ptroff_t)data);
} else if(*p == 'r') { // integer
skip = (c->branch->pos) - c->pos - 4;
len += swf_SetS24(tag, skip);
} else if(*p == 's') { // string
- int index = pool_register_string(pool, data);
+ int index = pool_register_string2(pool, (string_t*)data);
len += swf_SetU30(tag, index);
} else if(*p == 'D') { // debug statement
if(tag)
int stackpos;
int scopepos;
code_t*code;
- char seen;
+ char flags;
+ char error;
} stackpos_t;
typedef struct {
stats->maxlocal = reg+1;
}
+#define FLAG_SEEN 1
+#define FLAG_ERROR 2
+
static void dumpstack(currentstats_t*stats)
{
int t;
for(t=0;t<stats->num;t++) {
code_t*c = stats->stack[t].code;
opcode_t*op = opcode_get(c->opcode);
- printf("%5d) %c %d:%d %s", t, stats->stack[t].seen?'x':'|',
+ printf("%5d) %c %d:%d %s", t, (stats->stack[t].flags&FLAG_SEEN)?'x':'|',
stats->stack[t].stackpos,
stats->stack[t].scopepos,
op->name);
printf(" 00000000\n");
}
if(op->params[0]=='2') {
- printf(" %s", multiname_to_string(c->data[0]));
+ printf(" %s", multiname_tostring(c->data[0]));
}
printf("\n");
}
static char callcode(currentstats_t*stats, int pos, int stack, int scope)
{
while(pos<stats->num) {
- if(stats->stack[pos].seen) {
+ if(stats->stack[pos].flags&FLAG_SEEN) {
if(stats->stack[pos].stackpos != stack ||
stats->stack[pos].scopepos != scope) {
- dumpstack(stats);
+ //dumpstack(stats);
+ stats->stack[pos].flags |= FLAG_ERROR;
fprintf(stderr, "Stack mismatch at pos %d\n", pos);
fprintf(stderr, "Should be: %d:%d, is: %d:%d\n", stack, scope,
stats->stack[pos].stackpos, stats->stack[pos].scopepos);
- return 0;
+
+ /* return error here if we do verification */
+ //return 0;
}
return 1;
}
- stats->stack[pos].seen = 1;
+ stats->stack[pos].flags |= FLAG_SEEN;
stats->stack[pos].stackpos = stack;
stats->stack[pos].scopepos = scope;
stack += stack_minus(c);
if(stack<0) {
+ stats->stack[pos].flags |= FLAG_ERROR;
fprintf(stderr, "error: stack underflow at %d (%s)\n", pos, op->name);
- printf("error: stack underflow at %d (%s)\n", pos, op->name);exit(0);
- return 0;
+
+ /* if we would do true verification (if we would be a vm), this is
+ where we would return the error
+ return 0;
+ */
}
stack += op->stack_plus;
stats->flags |= FLAGS_SET_DXNS;
if(op->flags & OP_NEED_ACTIVATION)
stats->flags |= FLAGS_ACTIVATION;
+
+ if(c->opcode == OPCODE_NEWCLASS) {
+ abc_class_t*cls = (abc_class_t*)(c->data[0]);
+ if(scope > cls->init_scope_depth)
+ cls->init_scope_depth = scope;
+ }
+ if(c->opcode == OPCODE_NEWFUNCTION) {
+ abc_method_t*m = (abc_method_t*)(c->data[0]);
+ if(m->body && scope > m->body->init_scope_depth)
+ m->body->init_scope_depth = scope;
+ }
if(op->flags & OP_REGISTER) {
char*p = op->params;
}
if(op->flags&OP_RETURN) {
if(OP_RETURN==0x48/*returnvalue*/) {
- if(stack!=1)
+ if(stack!=1) {
+ stats->stack[pos].flags |= FLAG_ERROR;
fprintf(stderr, "return(value) with stackposition %d\n", stack);
+ }
} else if(OP_RETURN==0x47) {
- if(stack!=0)
+ if(stack!=0) {
+ stats->stack[pos].flags |= FLAG_ERROR;
fprintf(stderr, "return(void) with stackposition %d\n", stack);
+ }
}
}
if(op->flags & (OP_THROW|OP_RETURN))
return 1;
if(op->flags & OP_JUMP) {
if(!c->branch) {
+ stats->stack[pos].flags |= FLAG_ERROR;
fprintf(stderr, "Error: Invalid jump target in instruction %s at position %d.\n", op->name, pos);
return 0;
}
}
if(op->flags & OP_BRANCH) {
if(!c->branch) {
+ stats->stack[pos].flags |= FLAG_ERROR;
fprintf(stderr, "Error: Invalid jump target in instruction %s at position %d\n", op->name, pos);
return 0;
}
if(op->flags & OP_LOOKUPSWITCH) {
lookupswitch_t*l = c->data[0];
if(!l->def) {
+ stats->stack[pos].flags |= FLAG_ERROR;
fprintf(stderr, "Error: Invalid jump target in instruction %s at position %d\n", op->name, pos);
return 0;
}
code_list_t*t = l->targets;
while(t) {
if(!t->code) {
+ stats->stack[pos].flags |= FLAG_ERROR;
fprintf(stderr, "Error: Invalid jump target in instruction %s at position %d\n", op->name, pos);
return 0;
}
return 1;
}
-static currentstats_t* code_get_stats(code_t*code, exception_list_t*exceptions)
+static currentstats_t* code_get_stats(code_t*code, abc_exception_list_t*exceptions)
{
code = code_find_start(code);
int num = 0;
if(op->flags & (OP_JUMP|OP_BRANCH)) {
printf("%5d) %s %08x\n", t, op->name, c->branch);
} else if(op->params[0]=='2') {
- printf("%5d) %s %s\n", t, op->name, multiname_to_string(c->data[0]));
+ printf("%5d) %s %s\n", t, op->name, multiname_tostring(c->data[0]));
} else {
printf("%5d) %s\n", t, op->name);
}
free(current);
return 0;
}
- exception_list_t*e = exceptions;
+ abc_exception_list_t*e = exceptions;
while(e) {
- if(e->exception->target)
- callcode(current, e->exception->target->pos, 1, 0);
+ if(e->abc_exception->target)
+ callcode(current, e->abc_exception->target->pos, 1, 0);
e = e->next;
}
void stats_free(currentstats_t*stats)
{
- free(stats->stack);stats->stack=0;
- free(stats);
+ if(stats) {
+ free(stats->stack);stats->stack=0;
+ free(stats);
+ }
}
-int code_dump(code_t*c, exception_list_t*exceptions, abc_file_t*file, char*prefix, FILE*fo)
+int code_dump(code_t*c, abc_exception_list_t*exceptions, abc_file_t*file, char*prefix, FILE*fo)
{
- exception_list_t*e = exceptions;
+ abc_exception_list_t*e = exceptions;
c = code_find_start(c);
currentstats_t*stats = code_get_stats(c, exceptions);
e = exceptions;
while(e) {
- if(c==e->exception->from)
+ if(c==e->abc_exception->from)
fprintf(fo, "%s TRY {\n", prefix);
- if(c==e->exception->target) {
- char*s1 = multiname_to_string(e->exception->exc_type);
- char*s2 = multiname_to_string(e->exception->var_name);
+ if(c==e->abc_exception->target) {
+ char*s1 = multiname_tostring(e->abc_exception->exc_type);
+ char*s2 = multiname_tostring(e->abc_exception->var_name);
fprintf(fo, "%s CATCH(%s %s)\n", prefix, s1, s2);
free(s1);
free(s2);
char first = 1;
int i=0;
- fprintf(fo, "%s%5d) %c %d:%d %s ", prefix, c->pos, stats->stack[c->pos].seen?'x':'|',
- stats->stack[c->pos].stackpos,
- stats->stack[c->pos].scopepos,
- op->name);
+ if(stats) {
+ int f = stats->stack[c->pos].flags;
+ fprintf(fo, "%s%5d) %c %d:%d %s ", prefix, c->pos,
+ (f&FLAG_ERROR)?'E':((f&FLAG_SEEN)?'+':'|'),
+ stats->stack[c->pos].stackpos,
+ stats->stack[c->pos].scopepos,
+ op->name);
+ } else {
+ fprintf(fo, "%s%5d) ? ?:? %s ", prefix, c->pos, op->name);
+ }
while(*p) {
void*data = c->data[i];
fprintf(fo, "%d params", n);
} else if(*p == '2') {
multiname_t*n = (multiname_t*)data;
- char* m = multiname_to_string(n);
+ char* m = multiname_tostring(n);
fprintf(fo, "%s", m);
free(m);
} else if(*p == 'm') {
abc_method_t*m = (abc_method_t*)data;
- fprintf(fo, "[method %s]", m->name);
+ fprintf(fo, "[method %08x %s]", m, m->name);
} else if(*p == 'c') {
abc_class_t*cls = (abc_class_t*)data;
- char*classname = multiname_to_string(cls->classname);
+ char*classname = multiname_tostring(cls->classname);
fprintf(fo, "[classinfo %s]", classname);
free(classname);
} else if(*p == 'i') {
abc_method_body_t*b = (abc_method_body_t*)data;
fprintf(fo, "[methodbody]");
- } else if(*p == 'u') {
+ } else if(*p == 'u' || *p == 'I' || *p == 'U') {
int n = (ptroff_t)data;
fprintf(fo, "%d", n);
+ } else if(*p == 'f') {
+ double f = *(double*)data;
+ fprintf(fo, "%f", f);
} else if(*p == 'r') {
int n = (ptroff_t)data;
fprintf(fo, "r%d", n);
else
fprintf(fo, "%08x", c->branch);
} else if(*p == 's') {
- fprintf(fo, "\"%s\"", data);
+ char*s = string_escape((string_t*)data);
+ fprintf(fo, "\"%s\"", s);
+ free(s);
} else if(*p == 'D') {
fprintf(fo, "[register %02x=%s]", (ptroff_t)c->data[1], (char*)c->data[0]);
} else if(*p == 'S') {
e = exceptions;
while(e) {
- if(c==e->exception->to) {
- if(e->exception->target)
- fprintf(fo, "%s } // END TRY (HANDLER: %d)\n", prefix, e->exception->target->pos);
+ if(c==e->abc_exception->to) {
+ if(e->abc_exception->target)
+ fprintf(fo, "%s } // END TRY (HANDLER: %d)\n", prefix, e->abc_exception->target->pos);
else
fprintf(fo, "%s } // END TRY (HANDLER: 00000000)\n", prefix);
}
return 1;
}
-codestats_t* code_get_statistics(code_t*code, exception_list_t*exceptions)
+codestats_t* code_get_statistics(code_t*code, abc_exception_list_t*exceptions)
{
currentstats_t*current = code_get_stats(code, exceptions);
if(!current)
codestats_t*stats = rfx_calloc(sizeof(codestats_t));
stats->local_count = current->maxlocal;
stats->max_stack = current->maxstack;
- stats->init_scope_depth = 0;
stats->max_scope_depth = current->maxscope;
stats->flags = current->flags;
tmp->next = 0;
if(atag) {
tmp->prev = atag;
+ tmp->next = atag->next;
atag->next = tmp;
} else {
tmp->prev = 0;
{
printf("max_stack: %d\n", stats->max_stack);
printf("local_count: %d\n", stats->local_count);
- printf("init_scope_depth: %d\n", stats->init_scope_depth);
- printf("max_scope_depth: %d\n", stats->max_scope_depth);
+ printf("scope_depth: %d\n", stats->max_scope_depth);
+}
+
+code_t* code_end(code_t*code)
+{
+ if(!code)
+ return 0;
+ while(code->next)
+ code = code->next;
+ return code;
+}
+
+code_t* code_append(code_t*code, code_t*toappend)
+{
+ if(!code)
+ return code_end(toappend);
+ if(!toappend)
+ return code_end(code);
+ //find end of first list
+ while(code->next) {
+ code = code->next;
+ }
+ code_t*start=toappend;
+ //and start of second list
+ while(start->prev) {
+ start = start->prev;
+ }
+ code->next = start;
+ start->prev = code;
+ return code_end(toappend);
+}
+
+lookupswitch_t*lookupswitch_dup(lookupswitch_t*l)
+{
+ lookupswitch_t*n = malloc(sizeof(lookupswitch_t));
+ fprintf(stderr, "Error: lookupswitch dupping not supported yet\n");
+ n->targets = list_clone(l->targets);
+ return 0;
+}
+
+code_t*code_dup(code_t*c)
+{
+ if(!c) return 0;
+
+ while(c->prev) c = c->prev;
+
+ code_t*last = 0;
+ while(c) {
+ NEW(code_t, n);
+ memcpy(n, c, sizeof(code_t));
+
+ opcode_t*op = opcode_get(c->opcode);
+ if(c->branch) {
+ fprintf(stderr, "Error: Can't duplicate branching code\n");
+ return 0;
+ }
+ char*p = op?op->params:"";
+ int pos=0;
+ while(*p) {
+ if(*p == '2') { //multiname
+ c->data[pos] = multiname_clone(c->data[pos]);
+ } else if(*p == 's') {
+ c->data[pos] = string_dup3(c->data[pos]);
+ } else if(*p == 'D') {
+ c->data[pos] = strdup(c->data[pos]);
+ } else if(*p == 'f') {
+ double old = *(double*)c->data[pos];
+ c->data[pos] = malloc(sizeof(double));
+ *(double*)c->data[pos] = old;
+ } else if(strchr("S", *p)) {
+ c->data[pos] = lookupswitch_dup(c->data[pos]);
+ }
+ p++;pos++;
+ }
+
+ n->prev = last;
+ if(last) {
+ last->next = n;
+ }
+ last = n;
+ c = c->next;
+ }
+ return last;
+}
+
+code_t*code_cut(code_t*c)
+{
+ if(!c) return c;
+ code_t*prev = c->prev;
+ code_t*next = c->next;
+ c->prev = 0;
+ c->next = 0;
+ if(prev) prev->next=next;
+ if(next) next->prev=prev;
+ code_free(c);
+
+ if(next) return code_end(next);
+ else return prev;
+}
+
+code_t*code_cutlast(code_t*c)
+{
+ if(!c) return c;
+ assert(!c->next);
+ return code_cut(c);
+}
+
+code_t* cut_last_push(code_t*c)
+{
+ while(c) {
+ if(!c) break;
+ opcode_t*op = opcode_get(c->opcode);
+ /* cut conversion type operations */
+ if(op->stack_minus == -1 && op->stack_plus == 1 && !(op->flags)) {
+ c = code_cutlast(c);
+ continue;
+ }
+ /* cut any type of push */
+ else if(op->stack_minus == 0 && op->stack_plus == 1 && !(op->flags)) {
+ return code_cutlast(c);
+ }
+ /* cut register lookups */
+ else if(c->opcode == OPCODE_GETLOCAL ||
+ c->opcode == OPCODE_GETLOCAL_0 ||
+ c->opcode == OPCODE_GETLOCAL_1 ||
+ c->opcode == OPCODE_GETLOCAL_2 ||
+ c->opcode == OPCODE_GETLOCAL_3) {
+ return code_cutlast(c);
+ }
+ /* discard function call values */
+ else if(c->opcode == OPCODE_CALLPROPERTY) {
+ c->opcode = OPCODE_CALLPROPVOID;
+ return c;
+ } else if(c->opcode == OPCODE_CALLSUPER) {
+ c->opcode = OPCODE_CALLSUPERVOID;
+ return c;
+ } else if(c->opcode == OPCODE_NEWOBJECT ||
+ c->opcode == OPCODE_NEWARRAY) {
+ // we can discard these if they're not eating up stack parameters
+ if(!c->data[0])
+ return code_cutlast(c);
+ } else if(op->stack_minus ==0 && op->stack_plus == 0 &&
+ !(op->flags&~(OP_REGISTER|OP_SET_DXNS)) && c->prev) {
+ // trim code *before* the kill, inclocal, declocal, dxns
+ code_t*p = c->prev;
+ p->next = 0;
+ c->prev = 0;
+ return code_append(cut_last_push(p), c);
+ } else
+ break;
+ }
+ c = abc_pop(c);
+ return c;
}
+