bpf_image.c 7.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332
  1. /*
  2. * Copyright (c) 1990, 1991, 1992, 1994, 1995, 1996
  3. * The Regents of the University of California. All rights reserved.
  4. *
  5. * Redistribution and use in source and binary forms, with or without
  6. * modification, are permitted provided that: (1) source code distributions
  7. * retain the above copyright notice and this paragraph in its entirety, (2)
  8. * distributions including binary code include the above copyright notice and
  9. * this paragraph in its entirety in the documentation or other materials
  10. * provided with the distribution, and (3) all advertising materials mentioning
  11. * features or use of this software display the following acknowledgement:
  12. * ``This product includes software developed by the University of California,
  13. * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14. * the University nor the names of its contributors may be used to endorse
  15. * or promote products derived from this software without specific prior
  16. * written permission.
  17. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18. * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19. * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20. */
  21. #ifdef HAVE_CONFIG_H
  22. #include <config.h>
  23. #endif
  24. #include <pcap-types.h>
  25. #include <stdio.h>
  26. #include <string.h>
  27. #include "pcap-int.h"
  28. #ifdef HAVE_OS_PROTO_H
  29. #include "os-proto.h"
  30. #endif
  31. char *
  32. bpf_image(const struct bpf_insn *p, int n)
  33. {
  34. const char *op;
  35. static char image[256];
  36. char operand_buf[64];
  37. const char *operand;
  38. switch (p->code) {
  39. default:
  40. op = "unimp";
  41. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "0x%x", p->code);
  42. operand = operand_buf;
  43. break;
  44. case BPF_RET|BPF_K:
  45. op = "ret";
  46. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#%d", p->k);
  47. operand = operand_buf;
  48. break;
  49. case BPF_RET|BPF_A:
  50. op = "ret";
  51. operand = "";
  52. break;
  53. case BPF_LD|BPF_W|BPF_ABS:
  54. op = "ld";
  55. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "[%d]", p->k);
  56. operand = operand_buf;
  57. break;
  58. case BPF_LD|BPF_H|BPF_ABS:
  59. op = "ldh";
  60. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "[%d]", p->k);
  61. operand = operand_buf;
  62. break;
  63. case BPF_LD|BPF_B|BPF_ABS:
  64. op = "ldb";
  65. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "[%d]", p->k);
  66. operand = operand_buf;
  67. break;
  68. case BPF_LD|BPF_W|BPF_LEN:
  69. op = "ld";
  70. operand = "#pktlen";
  71. break;
  72. case BPF_LD|BPF_W|BPF_IND:
  73. op = "ld";
  74. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "[x + %d]", p->k);
  75. operand = operand_buf;
  76. break;
  77. case BPF_LD|BPF_H|BPF_IND:
  78. op = "ldh";
  79. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "[x + %d]", p->k);
  80. operand = operand_buf;
  81. break;
  82. case BPF_LD|BPF_B|BPF_IND:
  83. op = "ldb";
  84. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "[x + %d]", p->k);
  85. operand = operand_buf;
  86. break;
  87. case BPF_LD|BPF_IMM:
  88. op = "ld";
  89. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#0x%x", p->k);
  90. operand = operand_buf;
  91. break;
  92. case BPF_LDX|BPF_IMM:
  93. op = "ldx";
  94. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#0x%x", p->k);
  95. operand = operand_buf;
  96. break;
  97. case BPF_LDX|BPF_MSH|BPF_B:
  98. op = "ldxb";
  99. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "4*([%d]&0xf)", p->k);
  100. operand = operand_buf;
  101. break;
  102. case BPF_LD|BPF_MEM:
  103. op = "ld";
  104. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "M[%d]", p->k);
  105. operand = operand_buf;
  106. break;
  107. case BPF_LDX|BPF_MEM:
  108. op = "ldx";
  109. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "M[%d]", p->k);
  110. operand = operand_buf;
  111. break;
  112. case BPF_ST:
  113. op = "st";
  114. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "M[%d]", p->k);
  115. operand = operand_buf;
  116. break;
  117. case BPF_STX:
  118. op = "stx";
  119. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "M[%d]", p->k);
  120. operand = operand_buf;
  121. break;
  122. case BPF_JMP|BPF_JA:
  123. op = "ja";
  124. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "%d", n + 1 + p->k);
  125. operand = operand_buf;
  126. break;
  127. case BPF_JMP|BPF_JGT|BPF_K:
  128. op = "jgt";
  129. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#0x%x", p->k);
  130. operand = operand_buf;
  131. break;
  132. case BPF_JMP|BPF_JGE|BPF_K:
  133. op = "jge";
  134. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#0x%x", p->k);
  135. operand = operand_buf;
  136. break;
  137. case BPF_JMP|BPF_JEQ|BPF_K:
  138. op = "jeq";
  139. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#0x%x", p->k);
  140. operand = operand_buf;
  141. break;
  142. case BPF_JMP|BPF_JSET|BPF_K:
  143. op = "jset";
  144. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#0x%x", p->k);
  145. operand = operand_buf;
  146. break;
  147. case BPF_JMP|BPF_JGT|BPF_X:
  148. op = "jgt";
  149. operand = "x";
  150. break;
  151. case BPF_JMP|BPF_JGE|BPF_X:
  152. op = "jge";
  153. operand = "x";
  154. break;
  155. case BPF_JMP|BPF_JEQ|BPF_X:
  156. op = "jeq";
  157. operand = "x";
  158. break;
  159. case BPF_JMP|BPF_JSET|BPF_X:
  160. op = "jset";
  161. operand = "x";
  162. break;
  163. case BPF_ALU|BPF_ADD|BPF_X:
  164. op = "add";
  165. operand = "x";
  166. break;
  167. case BPF_ALU|BPF_SUB|BPF_X:
  168. op = "sub";
  169. operand = "x";
  170. break;
  171. case BPF_ALU|BPF_MUL|BPF_X:
  172. op = "mul";
  173. operand = "x";
  174. break;
  175. case BPF_ALU|BPF_DIV|BPF_X:
  176. op = "div";
  177. operand = "x";
  178. break;
  179. case BPF_ALU|BPF_MOD|BPF_X:
  180. op = "mod";
  181. operand = "x";
  182. break;
  183. case BPF_ALU|BPF_AND|BPF_X:
  184. op = "and";
  185. operand = "x";
  186. break;
  187. case BPF_ALU|BPF_OR|BPF_X:
  188. op = "or";
  189. operand = "x";
  190. break;
  191. case BPF_ALU|BPF_XOR|BPF_X:
  192. op = "xor";
  193. operand = "x";
  194. break;
  195. case BPF_ALU|BPF_LSH|BPF_X:
  196. op = "lsh";
  197. operand = "x";
  198. break;
  199. case BPF_ALU|BPF_RSH|BPF_X:
  200. op = "rsh";
  201. operand = "x";
  202. break;
  203. case BPF_ALU|BPF_ADD|BPF_K:
  204. op = "add";
  205. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#%d", p->k);
  206. operand = operand_buf;
  207. break;
  208. case BPF_ALU|BPF_SUB|BPF_K:
  209. op = "sub";
  210. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#%d", p->k);
  211. operand = operand_buf;
  212. break;
  213. case BPF_ALU|BPF_MUL|BPF_K:
  214. op = "mul";
  215. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#%d", p->k);
  216. operand = operand_buf;
  217. break;
  218. case BPF_ALU|BPF_DIV|BPF_K:
  219. op = "div";
  220. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#%d", p->k);
  221. operand = operand_buf;
  222. break;
  223. case BPF_ALU|BPF_MOD|BPF_K:
  224. op = "mod";
  225. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#%d", p->k);
  226. operand = operand_buf;
  227. break;
  228. case BPF_ALU|BPF_AND|BPF_K:
  229. op = "and";
  230. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#0x%x", p->k);
  231. operand = operand_buf;
  232. break;
  233. case BPF_ALU|BPF_OR|BPF_K:
  234. op = "or";
  235. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#0x%x", p->k);
  236. operand = operand_buf;
  237. break;
  238. case BPF_ALU|BPF_XOR|BPF_K:
  239. op = "xor";
  240. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#0x%x", p->k);
  241. operand = operand_buf;
  242. break;
  243. case BPF_ALU|BPF_LSH|BPF_K:
  244. op = "lsh";
  245. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#%d", p->k);
  246. operand = operand_buf;
  247. break;
  248. case BPF_ALU|BPF_RSH|BPF_K:
  249. op = "rsh";
  250. (void)pcap_snprintf(operand_buf, sizeof operand_buf, "#%d", p->k);
  251. operand = operand_buf;
  252. break;
  253. case BPF_ALU|BPF_NEG:
  254. op = "neg";
  255. operand = "";
  256. break;
  257. case BPF_MISC|BPF_TAX:
  258. op = "tax";
  259. operand = "";
  260. break;
  261. case BPF_MISC|BPF_TXA:
  262. op = "txa";
  263. operand = "";
  264. break;
  265. }
  266. if (BPF_CLASS(p->code) == BPF_JMP && BPF_OP(p->code) != BPF_JA) {
  267. (void)pcap_snprintf(image, sizeof image,
  268. "(%03d) %-8s %-16s jt %d\tjf %d",
  269. n, op, operand, n + 1 + p->jt, n + 1 + p->jf);
  270. } else {
  271. (void)pcap_snprintf(image, sizeof image,
  272. "(%03d) %-8s %s",
  273. n, op, operand);
  274. }
  275. return image;
  276. }