rendered paste body; This source is in the public domain. Loosely based on code originally written
; by Maxxuss, rufus, and semthex. (last modified: 7/26/07 2:04:10)
;
; To generate code for additional slots (unlimited, though this source expects
; three), simply copy-and-paste both the patching routines and code templates
; and replace all instances of cs1 to csN (also adjusting slotN accordingly).
bits 32
org 0xffff4000
start1:
push eax
restart:
lock inc dword [cs1_counter]
cs jnz start2
mov eax, [esp+0x4]
mov [cs1+0x38], eax ; store opcode
pop eax
mov dword [esp], slot1
iret
; ------------------------------------------------------------------------------
start2:
lock inc dword [cs2_counter]
cs jnz start3
mov eax, [esp+0x4]
mov [cs2+0x38], eax ; store opcode
pop eax
mov dword [esp], slot2
iret
; ------------------------------------------------------------------------------
start3:
lock inc dword [cs3_counter]
cs jnz reset
mov eax, [esp+0x4]
mov [cs3+0x38], eax ; store opcode
pop eax
mov dword [esp], slot3
iret
; ------------------------------------------------------------------------------
reset:
mov eax, counta
inc dword [eax]
mov eax, [eax]
and eax, 0xffff
jnz near restart
inc dword [countb]
xor eax, eax
dec eax
mov [cs1_counter], eax
mov [cs2_counter], eax
mov [cs3_counter], eax
jmp restart
; ********************************************************************
; ****************************** SLOT 1 ******************************
; ********************************************************************
align 4, nop
slot1:
pushf
push esi
push edi
push eax
push ecx
push edx
push ebx
mov edx, [cs1+0x38]
mov ecx, [edx]
mov eax, ecx
cmp cl, 0xdf ; m16int
jz cs1_do_fisttp
cmp cl, 0xdb ; m32int
jz cs1_do_fisttp
cmp cl, 0xdd ; m64int
jz cs1_do_fisttp
jmp cs1_not_fisttp
; ----------------------------------------------------------------------------
cs1_do_fisttp: ; beware: http://osdir.com/ml/lang.nasm.devel/2005-09/msg00054.html
mov edx, eax
shr edx, 8
and edx, 0x38
shr edx, 3
cmp edx, 1
jnz near cs1_not_fisttp
; ----------------------------------------------------------------------------
mov word [cs1_fisttp+32], 0x909c
mov dword [cs1_fisttp+34], 0x90909090
mov edx, eax ; fisttp begins
shr eax, 8
and eax, 0xff
mov esi, [cs1+0x38]
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
add eax, 2
mov ecx, eax
mov edi, cs1_fisttp+31
rep movsb
cmp dl, 0xdd ; m64int
jnz cs1_do_fisttp_not_m64int
mov byte [cs1_fisttp+31], 0xdf
or byte [cs1_fisttp+32], 0x38
jmp cs1_do_fisttp_done
cs1_do_fisttp_not_m64int:
or byte [cs1_fisttp+32], 0x18
cs1_do_fisttp_done:
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
jmp cs1_fisttp
; ----------------------------------------------------------------------------
cs1_do_lddqu:
mov word [cs1_lddqu+3], 0x9084
mov dword [cs1_lddqu+5], 0x90909090
shr eax, 0x18 ; lddqu begins
mov esi, [cs1+0x38]
add esi, 3
mov ebx, modrm_table
xlatb
add eax, 1
mov ecx, eax
add eax, 3
add dword [cs1+0x38], eax
mov edx, ecx
mov edi, cs1_lddqu+0x3
rep movsb
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
jmp cs1_lddqu
; ----------------------------------------------------------------------------
cs1_not_fisttp:
and ecx, 0xffffff
cmp ecx, 0xf00ff2 ; check for lddqu
jz cs1_do_lddqu
cmp ecx, 0x120ff2 ; check if movddup
jz cs1_do_movddup
cmp ecx, 0x7c0f66 ; check for haddpd
jz cs1_do_haddpd
jmp cs1_check9
; ----------------------------------------------------------------------------
cs1_do_movddup:
mov word [cs1_movddup+3], 0x9084
mov dword [cs1_movddup+5], 0x90909090
shr eax, 0x18 ; movddup begins
mov edx, eax
and eax, 0xc7
mov [cs1_movddup+0x3], al
mov esi, [cs1+0x38]
add esi, 4
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
mov ecx, eax
mov edi, cs1_movddup+0x4
rep movsb
and edx, 0x38
or edx, 5
mov [cs1_movddup+0x1c], dl
mov [cs1_movddup+0x24], dl
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
movupd [cs1_temp_xmm0], xmm0
jmp cs1_movddup
; ----------------------------------------------------------------------------
cs1_do_haddpd:
mov word [cs1_haddpd+11], 0x9084
mov dword [cs1_haddpd+13], 0x90909090
shr eax, 0x18 ; haddpd begins
mov edx, eax
and eax, 0xc7
mov [cs1_haddpd+0xb], al
mov esi, [cs1+0x38]
add esi, 4
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
mov ecx, eax
mov edi, cs1_haddpd+0xc
rep movsb
and edx, 0x38
or edx, 5
mov [cs1_haddpd+0x3], dl
mov [cs1_haddpd+0x5c], dl
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
movupd [cs1_temp_xmm0], xmm0
movupd [cs1_temp_xmm1], xmm1
jmp cs1_haddpd
; ----------------------------------------------------------------------------
cs1_check9:
cmp ecx, 0x7d0f66 ; check for hsubpd
jz cs1_do_hsubpd
cmp ecx, 0xd00f66 ; check for addsubpd
jz cs1_do_addsubpd
jmp cs1_check10
cs1_do_hsubpd:
mov word [cs1_hsubpd+11], 0x9084
mov dword [cs1_hsubpd+13], 0x90909090
shr eax, 0x18 ; hsubpd begins
mov edx, eax
and eax, 0xc7
mov [cs1_hsubpd+0xb], al
mov esi, [cs1+0x38]
add esi, 4
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
mov ecx, eax
mov edi, cs1_hsubpd+0xc
rep movsb
and edx, 0x38
or edx, 5
mov [cs1_hsubpd+0x3], dl
mov [cs1_hsubpd+0x60], dl
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
movupd [cs1_temp_xmm0], xmm0
movupd [cs1_temp_xmm1], xmm1
jmp cs1_hsubpd
; ----------------------------------------------------------------------------
cs1_do_addsubpd:
mov word [cs1_addsubpd+11], 0x9084
mov dword [cs1_addsubpd+13], 0x90909090
shr eax, 0x18 ; addsubpd begins
mov edx, eax
and eax, 0xc7
mov [cs1_addsubpd+0xb], al
mov esi, [cs1+0x38]
add esi, 4
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
mov ecx, eax
mov edi, cs1_addsubpd+0xc
rep movsb
and edx, 0x38
or edx, 5
mov [cs1_addsubpd+0x3], dl
mov [cs1_addsubpd+0x5c], dl
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
movupd [cs1_temp_xmm0], xmm0
movupd [cs1_temp_xmm1], xmm1
jmp cs1_addsubpd
; ----------------------------------------------------------------------------
cs1_check10:
cmp ecx, 0x160ff3 ; check for movshdup
jz cs1_do_movshdup
cmp ecx, 0x120ff3 ; check for movsldup
jz cs1_do_movsldup
jmp cs1_check11
cs1_do_movshdup:
mov word [cs1_movshdup+2], 0x9084
mov dword [cs1_movshdup+4], 0x90909090
shr eax, 0x18 ; movshdup begins
mov edx, eax
and eax, 0xc7
mov [cs1_movshdup+0x2], al
mov esi, [cs1+0x38]
add esi, 4
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
mov ecx, eax
mov edi, cs1_movshdup+0x3
rep movsb
and edx, 0x38
or edx, 5
mov [cs1_movshdup+0x2c], dl
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
push eax
movups [cs1_temp_xmm0], xmm0
jmp cs1_movshdup
; ----------------------------------------------------------------------------
cs1_do_movsldup:
mov word [cs1_movsldup+2], 0x9084
mov dword [cs1_movsldup+4], 0x90909090
shr eax, 0x18 ; movsldup begins
mov edx, eax
and eax, 0xc7
mov [cs1_movsldup+0x2], al
mov esi, [cs1+0x38]
add esi, 4
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
mov ecx, eax
mov edi, cs1_movsldup+0x3
rep movsb
and edx, 0x38
or edx, 5
mov [cs1_movsldup+0x2c], dl
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
push eax
movups [cs1_temp_xmm0], xmm0
jmp cs1_movsldup
; ----------------------------------------------------------------------------
cs1_check11:
cmp ecx, 0x7c0ff2 ; check for haddps
jz cs1_do_haddps
cmp ecx, 0x7d0ff2 ; check for hsubps
jz cs1_do_hsubps
jmp cs1_check12
cs1_do_haddps:
mov word [cs1_haddps+9], 0x9084
mov dword [cs1_haddps+11], 0x90909090
shr eax, 0x18 ; haddps begins
mov edx, eax
and eax, 0xc7
mov [cs1_haddps+0x9], al
mov esi, [cs1+0x38]
add esi, 4
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
mov ecx, eax
mov edi, cs1_haddps+0xa
rep movsb
and edx, 0x38
or edx, 5
mov [cs1_haddps+2], dl
mov [cs1_haddps+143], dl
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
push eax
movups [cs1_temp_xmm0], xmm0
movups [cs1_temp_xmm1], xmm1
jmp cs1_haddps
; ----------------------------------------------------------------------------
cs1_do_hsubps:
mov word [cs1_hsubps+9], 0x9084
mov dword [cs1_hsubps+11], 0x90909090
shr eax, 0x18 ; hsubps begins
mov edx, eax
and eax, 0xc7
mov [cs1_hsubps+0x9], al
mov esi, [cs1+0x38]
add esi, 4
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
mov ecx, eax
mov edi, cs1_hsubps+0xa
rep movsb
and edx, 0x38
or edx, 5
mov [cs1_hsubps+2], dl
mov [cs1_hsubps+143], dl
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
push eax
movups [cs1_temp_xmm0], xmm0
movups [cs1_temp_xmm1], xmm1
jmp cs1_hsubps
; ----------------------------------------------------------------------------
cs1_check12:
cmp ecx, 0xd00ff2 ; check for addsubps
jz cs1_do_addsubps
jmp unknown
cs1_do_addsubps:
mov word [cs1_addsubps+9], 0x9084
mov dword [cs1_addsubps+11], 0x90909090
shr eax, 0x18 ; addsubps begins
mov edx, eax
and eax, 0xc7
mov [cs1_addsubps+0x9], al
mov esi, [cs1+0x38]
add esi, 4
mov ebx, modrm_table
xlatb
add dword [cs1+0x38], eax
mov ecx, eax
mov edi, cs1_addsubps+0xa
rep movsb
and edx, 0x38
or edx, 5
mov [cs1_addsubps+2], dl
mov [cs1_addsubps+106], dl
pop ebx
pop edx
pop ecx
pop eax
pop edi
pop esi
popf
push eax
movups [cs1_temp_xmm0], xmm0
movups [cs1_temp_xmm1], xmm1
jmp cs1_addsubps
; ----------------------------------------------------------------------------
; [slots 2/3 omitted]
unknown:
int 0xfd ; this won't return
align 16, db 0
modrm_table:
times 8 db 0, 0, 0, 0, 5, 4, 0, 0
times 8 db 1, 1, 1, 1, 2, 1, 1, 1
times 8 db 4, 4, 4, 4, 5, 4, 4, 4
times 64 db 0
align 16, db 0
cs1: times 56 db 0
cs1_opcode: dd 0x00000000
cs1_counter: dd 0xffffffff
cs2: times 56 db 0
cs2_opcode: dd 0x00000000
cs2_counter: dd 0xffffffff
cs3: times 56 db 0
cs3_opcode: dd 0x00000000
cs3_counter: dd 0xffffffff
cs1_temp_xmm0: times 16 db 0
cs1_temp_xmm1: times 16 db 0
cs1_temp_dst: times 16 db 0
cs2_temp_xmm0: times 16 db 0
cs2_temp_xmm1: times 16 db 0
cs2_temp_dst: times 16 db 0
cs3_temp_xmm0: times 16 db 0
cs3_temp_xmm1: times 16 db 0
cs3_temp_dst: times 16 db 0
counta: dd 0x00000000
countb: dd 0x00000000
; ********************************************************************
; ****************************** SLOT 1 ******************************
; ********************************************************************
align 4, nop
cs1_fisttp:
fnstcw [cs1+8]
push eax
movzx eax, word [cs1+8]
or eax, 0xc00
mov dword [cs1+4], eax
pop eax
fldcw [cs1+4]
fistp dword [eax+edx*4+0x90909090]
fldcw [cs1+8]
add dword [cs1+0x38], 0x2
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_lddqu:
movdqu xmm0, [eax+edx*4+0x90909090]
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_movddup:
movupd xmm0, [eax+edx*4+0x90909090]
movlpd [cs1], xmm0
movupd xmm0, [cs1_temp_xmm0]
movlpd xmm1, [cs1]
movhpd xmm1, [cs1]
add dword [cs1+0x38], 0x4
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_haddpd:
movupd [cs1_temp_dst], xmm7
movupd xmm0, [eax+edx*4+0x90909090]
movupd xmm1, [cs1_temp_dst]
movupd [cs1], xmm0
movlpd [cs1+0x10], xmm0
movhpd [cs1], xmm1
movhpd xmm1, [cs1+0x10]
addpd xmm1, [cs1]
movupd xmm0, [cs1_temp_xmm0]
movupd [cs1_temp_dst], xmm1
movupd xmm1, [cs1_temp_xmm1]
movupd xmm7, [cs1_temp_dst]
add dword [cs1+0x38], 0x4
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_hsubpd:
movupd [cs1_temp_dst], xmm7
movupd xmm0, [eax+edx*4+0x90909090]
movupd xmm1, [cs1_temp_dst]
movlpd [cs1], xmm0
movhpd [cs1+0x8], xmm1
movhpd xmm1, [cs1]
movlpd xmm0, [cs1+0x8]
subpd xmm1, xmm0
movlpd xmm0, [cs1]
movupd xmm0, [cs1_temp_xmm0]
movupd [cs1_temp_dst], xmm1
movupd xmm1, [cs1_temp_xmm1]
movupd xmm7, [cs1_temp_dst]
add dword [cs1+0x38], 0x4
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_addsubpd:
movupd [cs1_temp_dst], xmm7
movupd xmm0, [eax+edx*4+0x90909090]
movupd xmm1, [cs1_temp_dst]
movlpd [cs1], xmm1
addpd xmm1, xmm0
movhpd [cs1+0x8], xmm1
movlpd xmm1, [cs1]
subpd xmm1, xmm0
movhpd xmm1, [cs1+0x8]
movupd xmm0, [cs1_temp_xmm0]
movupd [cs1_temp_dst], xmm1
movupd xmm1, [cs1_temp_xmm1]
movupd xmm7, [cs1_temp_dst]
add dword [cs1+0x38], 0x4
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_movshdup:
movups xmm0, [eax+edx*4+0x90909090]
movups [cs1], xmm0
mov eax, [cs1+0xc]
mov [cs1+0x8], eax
mov eax, [cs1+0x4]
mov [cs1], eax
movups xmm0, [cs1_temp_xmm0]
movups xmm1, [cs1]
pop eax
add dword [cs1+0x38], 0x4
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_movsldup:
movups xmm0, [eax+edx*4+0x90909090]
movups [cs1], xmm0
mov eax, [cs1+0x8]
mov [cs1+0xc], eax
mov eax, [cs1]
mov [cs1+0x4], eax
movups xmm0, [cs1_temp_xmm0]
movups xmm1, [cs1]
pop eax
add dword [cs1+0x38], 0x4
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_haddps:
movups [cs1_temp_dst], xmm7
movups xmm0, [eax+edx*4+0x90909090]
movups xmm1, [cs1_temp_dst]
movups [cs1], xmm0
movups [cs1+0x20], xmm0
movups [cs1+0x10], xmm1
mov eax, [cs1+0x14]
mov [cs1], eax
mov eax, [cs1+0x1c]
mov [cs1+0x4], eax
mov eax, [cs1+0x24]
mov [cs1+0x8], eax
mov eax, [cs1+0x18]
mov [cs1+0x14], eax
mov eax, [cs1+0x28]
mov [cs1+0x1c], eax
mov eax, [cs1+0x20]
mov [cs1+0x18], eax
movups xmm0, [cs1]
movups xmm1, [cs1+0x10]
addps xmm1, xmm0
movups xmm0, [cs1_temp_xmm0]
movups [cs1_temp_dst], xmm1
movups xmm1, [cs1_temp_xmm1]
movups xmm7, [cs1_temp_dst]
pop eax
add dword [cs1+0x38], 0x4
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_hsubps:
movups [cs1_temp_dst], xmm7
movups xmm0, [eax+edx*4+0x90909090]
movups xmm1, [cs1_temp_dst]
movups [cs1], xmm0
movups [cs1+0x20], xmm0
movups [cs1+0x10], xmm1
mov eax, [cs1+0x14]
mov [cs1], eax
mov eax, [cs1+0x1c]
mov [cs1+0x4], eax
mov eax, [cs1+0x24]
mov [cs1+0x8], eax
mov eax, [cs1+0x18]
mov [cs1+0x14], eax
mov eax, [cs1+0x28]
mov [cs1+0x1c], eax
mov eax, [cs1+0x20]
mov [cs1+0x18], eax
movups xmm0, [cs1]
movups xmm1, [cs1+0x10]
subps xmm1, xmm0
movups xmm0, [cs1_temp_xmm0]
movups [cs1_temp_dst], xmm1
movups xmm1, [cs1_temp_xmm1]
movups xmm7, [cs1_temp_dst]
pop eax
add dword [cs1+0x38], 0x4
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
align 4, nop
cs1_addsubps:
movups [cs1_temp_dst], xmm7
movups xmm0, [eax+edx*4+0x90909090]
movups xmm1, [cs1_temp_dst]
movups [cs1], xmm1
addps xmm1, xmm0
movups [cs1+0x10], xmm1
movups xmm1, [cs1]
subps xmm1, xmm0
movups [cs1+0x20], xmm1
mov eax, [cs1+0x14]
mov [cs1+0x24], eax
mov eax, [cs1+0x1c]
mov [cs1+0x2C], eax
movups xmm1, [cs1+0x20]
movups xmm0, [cs1_temp_xmm0]
movups [cs1_temp_dst], xmm1
movups xmm1, [cs1_temp_xmm1]
movups xmm7, [cs1_temp_dst]
pop eax
add dword [cs1+0x38], 0x4
push dword [cs1+0x38]
mov dword [cs1_counter], 0xffffffff
ret
; ----------------------------------------------------------------------------
; [slots 2/3 omitted]
times 0x2000-($-$$) db 0