From f5a38323ef39ca7f1ef8f2db98b36e23d06bcf54 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andrius=20=C5=A0tikonas?= Date: Sun, 14 Aug 2022 22:31:13 +0100 Subject: [PATCH] Add catm.hex2 --- amd64/Development/catm.M1 | 8 +- amd64/catm.hex2 | 356 +++++++++++++++++++++++++++++++ amd64/mescc-tools-mini-kaem.kaem | 7 + 3 files changed, 367 insertions(+), 4 deletions(-) create mode 100644 amd64/catm.hex2 diff --git a/amd64/Development/catm.M1 b/amd64/Development/catm.M1 index c640c82..91d70b7 100644 --- a/amd64/Development/catm.M1 +++ b/amd64/Development/catm.M1 @@ -42,16 +42,16 @@ DEFINE LOAD64_into_R14_from_Address_RDX_Immediate8 4C8B72 DEFINE LOAD64_rel_RCX 488B0D DEFINE LOAD64_rel_RDX 488B15 DEFINE POP_RAX 58 -DEFINE PUSH 6A -DEFINE PUSH_RAX 50 -DEFINE PUSH_RBX 53 -DEFINE PUSH_RDX 52 DEFINE POP_RBX 5B DEFINE POP_RCX 59 DEFINE POP_RSI 5E DEFINE POP_R8 4158 DEFINE POP_R9 4159 DEFINE POP_R15 415F +DEFINE PUSH 6A +DEFINE PUSH_RAX 50 +DEFINE PUSH_RBX 53 +DEFINE PUSH_RDX 52 DEFINE RET C3 DEFINE ROR_R9 49D1C9 DEFINE STOREI8_into_Address_RBX C603 diff --git a/amd64/catm.hex2 b/amd64/catm.hex2 new file mode 100644 index 0000000..6fcd27f --- /dev/null +++ b/amd64/catm.hex2 @@ -0,0 +1,356 @@ +# SPDX-FileCopyrightText: 2022 Andrius Štikonas +# SPDX-FileCopyrightText: 2019 Jeremiah Orians +# +# SPDX-License-Identifier: GPL-3.0-or-later + +# DOS MZ header +4D 5A # Signature +00 00 # Number of bytes in the last page. +00 00 # Number of whole/partial pages +00 00 # Number of entries in the relocation table. +00 00 # Header size +00 00 # Minimum allocation +00 00 # Maximum allocation +00 00 # Relocatable segment address for SS +00 00 # Initial value for SP +00 00 # Checksum (I don't think is looked at) +00 00 # Initial value for IP (Seems ignored) +00 00 # Relocatable segment address for CS (Seems ignored) +00 00 # The (absolute) offset to the relocation table. +00 00 # Value used for overlay management. If zero, this is the main executable +00 00 00 00 00 00 00 00 # Reserved in PE +00 00 # OEM identifier +00 00 # OEM info +00 00 00 00 00 00 00 00 00 00 # The required reserved 20 bytes of NULLS +00 00 00 00 00 00 00 00 00 00 +40 00 00 00 # Starting address of the PE header + +# [0x40] +# PE header +50 45 00 00 # Signature "PE" +64 86 # Machine +01 00 # number of sections +00 00 00 00 # Timestamp supposedly +00 00 00 00 # PointerToSymbolTable +00 00 00 00 # number of symbols +F0 00 # SizeOfOptionalHeader +00 00 # 'Characteristics' + +# [0x58] +# COFF header bits +0B 02 # Magic PE32+ (64 bit) +00 00 # Linker version +00 00 00 00 # size of code +00 00 00 00 # sizeOfInitializedData +00 00 00 00 # SizeOfUninitializedData +00 10 00 00 # AddressOfEntryPoint +00 10 00 00 # BaseOfCode +00 00 00 80 01 00 00 00 # ImageBase +01 00 00 00 # SectionAlignment +01 00 00 00 # FileAlignment +00 00 00 00 # OperatingSystemVersion +00 00 00 00 # ImageVersion +00 00 00 00 # SubsystemVersion +00 00 00 00 # Win32VersionValue +00 20 00 00 # SizeOfImage +70 01 00 00 # SizeOfHeaders +00 00 00 00 # CheckSum (isn't used at all) +0A 00 # Subsystem +00 00 # DllCharacteristics +00 00 00 00 # SizeOfStackReserve +00 00 00 00 # SizeOfStackCommit +00 00 00 00 # SizeOfHeapReserve +00 00 00 00 # SizeOfHeapCommit +00 00 00 00 # LoaderFlags +00 00 00 00 # NumberOfRvaAndSizes + +# [0xB8] +# Data directories (has to be 16 entries always 16bytes per entry) +00 00 00 00 # Export Table +00 00 00 00 # Size of Export Table + +00 00 00 00 # Import Table +10 00 00 00 # Size of Import Table + +00 00 00 00 # Resource Table +00 00 00 00 # Size of Resource Table + +00 00 00 00 # Exception Table +00 00 00 00 # Size of Exception Table + +00 00 00 00 # Certificate Table +00 00 00 00 # Size of Certificate Table + +00 00 00 00 # Base Relocation Table +00 00 00 00 # Size of Base Relocation Table + +00 00 00 00 # Debug Table +00 00 00 00 # Size of Debug Table + +00 00 00 00 # Architecture Data Table +00 00 00 00 # Size of Architecture Data Table + +00 00 00 00 # Global Pointer +00 00 00 00 # NULL + +00 00 00 00 # TLS Table +00 00 00 00 # Size of TLS Table + +00 00 00 00 # Load Config Table +00 00 00 00 # Size of Load Config Table + +00 00 00 00 # Bound Import Table +00 00 00 00 # Size of Bound Import Table + +00 00 00 00 # Import Address Table +00 00 00 00 # Size of Import Address Table + +00 00 00 00 # Delay Import Descriptor Table +00 00 00 00 # Size of Delay Import Descriptor Table + +00 00 00 00 # CLR Runtime header table +00 00 00 00 # Size of CLR Runtime Header table + +00 00 00 00 00 00 00 00 # MUST BE NULL + +# no idea what it is yet +00 00 00 00 00 00 00 00 +00 00 00 00 00 00 00 00 + +# [0x148] +# Start of section headers +00 00 00 00 00 00 00 00 ; Name of the section (empty) but could set to ".text" +%PE32_end>PE32_text ; VirtualSize +00 10 00 00 ; VirtualAddress +%PE32_end>PE32_text ; SizeOfRawData +70 01 00 00 ; PointerToRawData +00 00 00 00 ; PointerToRelocations +00 00 00 00 ; PointerToLinenumbers +00 00 ; NumberOfRelocations +00 00 ; NumberOfLinenumbers +00 00 00 00 ; 'Characteristics' + +# [0x170] + +:PE32_text + +# efi_main(void *image_handle, struct efi_system_table *system) +:_start + + 4889E5 ; COPY_RSP_to_RBP # save stack pointer + 4989CF ; COPY_RCX_to_R15 # save image_handle + 4C8B72 60 ; LOAD64_into_R14_from_Address_RDX_Immediate8 !96 # system->boot + + # Open Loaded Image protocol + 50 ; PUSH_RAX # allocate stack for image + 4989E0 ; COPY_RSP_to_R8 # arg3 = &image + 488B15 %LOADED_IMAGE_PROTOCOL_8 ; LOAD64_rel_RDX %LOADED_IMAGE_PROTOCOL_8 # EFI_LOADED_IMAGE_PROTOCOL_GUID (last 64 bits) + 52 ; PUSH_RDX # push last 64 bits onto stack + 488B15 %LOADED_IMAGE_PROTOCOL ; LOAD64_rel_RDX %LOADED_IMAGE_PROTOCOL # EFI_LOADED_IMAGE_PROTOCOL_GUID (first 64 bits) + 52 ; PUSH_RDX # push first 64 bits onto stack + 4889E2 ; COPY_RSP_to_RDX # arg2 = &guid + 6A 01 ; PUSH !1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL + 6A 00 ; PUSH !0 # arg5 = NULL + 4D89F9 ; COPY_R15_to_R9 # arg4 = image_handle + 4C89F9 ; COPY_R15_to_RCX # arg1 = image_handle + 4883EC 20 ; SUBI8_RSP !32 # allocate shadow stack space for UEFI function + 41FF96 18010000 ; CALL_R14_Immediate32 %280 # system->boot->open_protocol(image_handle, &guid, &image, image_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL) + 488B4424 40 ; LOAD64_into_RAX_from_Address_RSP_Immediate8 !64 # get_image + 4889C7 ; COPY_RDI_to_RAX # save image + + # Get root file system + 50 ; PUSH_RAX # allocate stack for rootfs + 4989E0 ; COPY_RSP_to_R8 # arg3 = &rootfs + 488B15 %SIMPLE_FS_PROTOCOL_8 ; LOAD64_rel_RDX %SIMPLE_FS_PROTOCOL_8 # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID (last 64 bits) + 52 ; PUSH_RDX # push last 64 bits onto stack + 488B15 %SIMPLE_FS_PROTOCOL ; LOAD64_rel_RDX %SIMPLE_FS_PROTOCOL # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID (first 64 bits) + 52 ; PUSH_RDX # push first 64 bits onto stack + 4889E2 ; COPY_RSP_to_RDX # arg2 = &guid + 6A 01 ; PUSH !1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL + 6A 00 ; PUSH !0 # arg5 = NULL + 4D89F9 ; COPY_R15_to_R9 # arg4 = image_handle + 488B4F 18 ; LOAD64_into_RCX_from_Address_RDI_Immediate8 !24 # arg1 = root_device = image->device + 4883EC 20 ; SUBI8_RSP !32 # allocate shadow stack space for UEFI function + 41FF96 18010000 ; CALL_R14_Immediate32 %280 # system->boot->open_protocol(root_device, &guid, &rootfs, image_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL) + 488B4C24 40 ; LOAD64_into_RCX_from_Address_RSP_Immediate8 !64 # get rootfs + + # Get root directory + 52 ; PUSH_RDX # allocate stack for rootdir + 4889E2 ; COPY_RSP_to_RDX # arg2 = &rootdir + 50 ; PUSH_RAX # allocate shadow stack space for UEFI function + 50 ; PUSH_RAX # allocate shadow stack space for UEFI function + FF51 08 ; CALL_RCX_Immediate8 !8 # rootfs->open_volume(rootfs, &rootdir) + 58 ; POP_RAX # deallocate stack + 58 ; POP_RAX # deallocate stack + 58 ; POP_RAX # get rootdir + 488905 %rootdir ; STORE64_rel_RAX %rootdir # save rootdir + + # Push command line arguments onto stack + 488B5F 38 ; LOAD64_into_RBX_from_Address_RDI_Immediate8 !56 # options = image->load_options + 4889DA ; COPY_RBX_to_RDX # save beginning of load_options + 48035F 30 ; ADD_RBX_from_Address_RDI_Immediate8 !48 # go to the end of load_options + + 6A 00 ; PUSH !0 # Save end of arguments (NULL) onto stack +:loop_options + 4839D3 ; CMP_RBX_RDX # Check if we are done + 74 !loop_options_done ; JE8 !loop_options_done # We are done + 4883EB 02 ; SUBI8_RBX !2 # --options + 8A03 ; LOAD8_AL_from_Address_RBX # *options + 3C 20 ; CMPI8_AL !0x20 # if *options != ' ' + 75 !loop_options ; JNE8 !loop_options # then continue looping + C603 00 ; STOREI8_into_Address_RBX !0 # zero it + 4883C3 02 ; ADDI8_RBX !2 # ++options + 53 ; PUSH_RBX # push another argument onto stack + EB !loop_options ; JMP8 !loop_options # next argument +:loop_options_done + 4158 ; POP_R8 # get output file + + # Open file for writing + 52 ; PUSH_RDX # allocate stack for fout + 4889E2 ; COPY_RSP_to_RDX # arg2 = &fout + 6A 00 ; PUSH !0 # arg5 = 0 + 6A 07 ; PUSH !7 # to get 0x8000000000000003 we set the rightmost 3 bits + 4159 ; POP_R9 # and then do right rotation by 1 + 49D1C9 ; ROR_R9 # arg4 = EFI_FILE_MODE_CREATE| EFI_FILE_MODE_WRITE | EFI_FILE_MODE_READ + 488B0D %rootdir ; LOAD64_rel_RCX %rootdir # arg1 = rootdir + 4883EC 20 ; SUBI8_RSP !32 # allocate shadow stack space for UEFI function + FF51 08 ; CALL_RCX_Immediate8 !8 # rootdir->open() + 4883C4 28 ; ADDI8_RSP !40 # deallocate stack + 415F ; POP_R15 # get fout + + 48C7C2 00001000 ; ADDI32_to_RDX %0x100000 # Allocate 1MB + E8 %allocate_pool ; CALLI32 %allocate_pool # Get memory pool + 4889C3 ; COPY_RAX_to_RBX # Save it + +:core + 4158 ; POP_R8 # Get the actual input name + 4983F8 00 ; CMP_R8_Immediate8 !0 # Check for null string + 74 !done ; JE8 !done # We are done if null string + + E8 %open_file ; CALLI32 %open_file # Open file as read only + 85C0 ; TEST_EAX_EAX # check if successfully opened + 75 !core ; JNE8 !core # Else go to another file + 4989F5 ; COPY_RSI_to_R13 # Protect fin + +:keep + 48C7C2 00001000 ; ADDI32_to_RDX %0x100000 # set the size of chars we want + E8 %read ; CALLI32 %read # read them + 50 ; PUSH_RAX # Protect the number of bytes read + + 4889C2 ; COPY_RAX_to_RDX # number of bytes to write + E8 %write ; CALLI32 %write # write them + + 58 ; POP_RAX # Get bytes read + 483D 00001000 ; CMPI32_RAX %0x100000 # Check if buffer was fully used + 74 !keep ; JE8 !keep # Keep looping if it was full + + 4C89E9 ; COPY_R13_to_RCX # fin + E8 %close_file ; CALLI32 %close_file # close file + EB !core ; JMP8 !core # Move to next file + +:done + 4C89F9 ; COPY_R15_to_RCX # Get output file + E8 %close_file ; CALLI32 %close_file # close it + + 4889D9 ; COPY_RBX_to_RCX # Get buffer + E8 %free_pool ; CALLI32 %free_pool # release it + 31C0 ; XOR_EAX_EAX # Exit code 0 + + 4889EC ; COPY_RBP_to_RSP # restore stack + C3 ; RET # return to UEFI + +# r8: input file name +# returns input file handle in rsi, status in rax +:open_file + # Open file for reading + 52 ; PUSH_RDX # allocate stack for fin + 4889E2 ; COPY_RSP_to_RDX # arg2 = &fin + 6A 01 ; PUSH !1 # arg5 = EFI_FILE_READ_ONLY + 6A 01 ; PUSH !1 # prepare to set arg4 to EFI_FILE_MODE_READ + 4159 ; POP_R9 # arg4 = EFI_FILE_MODE_READ + 488B0D %rootdir ; LOAD64_rel_RCX %rootdir # arg1 = rootdir + 4883EC 20 ; SUBI8_RSP !32 # allocate shadow stack space for UEFI function + FF51 08 ; CALL_RCX_Immediate8 !8 # rootdir->open() + 4883C4 28 ; ADDI8_RSP !40 # deallocate stack + 5E ; POP_RSI # get fin + C3 ; RET + +# rcx: file handle +:close_file + 50 ; PUSH_RAX # allocate shadow stack space for UEFI function + FF51 10 ; CALL_RCX_Immediate8 !16 # file_handle->close(file_handle) + 58 ; POP_RAX # deallocate stack + C3 ; RET + +# rdx: number of bytes to allocate +# r14: system->boot +# returns pointer in rax +:allocate_pool + 52 ; PUSH_RDX # allocate stack for pool pointer + 4989E0 ; COPY_RSP_to_R8 # arg3 = &pool + 6A 02 ; PUSH !2 + 59 ; POP_RCX # arg1 = EFI_LOADER_DATA + 4883EC 18 ; SUBI8_RSP !24 # allocate shadow stack space for UEFI + 41FF56 40 ; CALL_R14_Immediate8 !64 # system->boot->allocate_pool(EFI_LOADER_DATA, 2048, &pool) + 4883C4 18 ; ADDI8_RSP !24 # deallocate stack + 58 ; POP_RAX # get pool + C3 ; RET + +# rcx: memory pool +# r14: system->boot +:free_pool + 50 ; PUSH_RAX # allocate shadow stack space for UEFI function + 41FF56 48 ; CALL_R14_Immediate8 !72 # system->boot->free_pool(pool) + 58 ; POP_RAX # deallocate stack + C3 ; RET + +# rdx: number of bytes to read +# rbx: buffer +# r13: input file handle +# returns number of bytes read in rax +:read + 4C89E9 ; COPY_R13_to_RCX # arg1 = fin + 52 ; PUSH_RDX # set size + 4889E2 ; COPY_RSP_to_RDX # arg2 = &size + 4989D8 ; COPY_RBX_to_R8 # arg3 = buffer + 4883EC 18 ; SUBI8_RSP !24 # allocate shadow stack space for UEFI + FF51 20 ; CALL_RCX_Immediate8 !32 # fin->read() + 4883C4 18 ; ADDI8_RSP !24 # deallocate stack + 58 ; POP_RAX # save size to rax + C3 ; RET + +# rdx: number of bytes to write +# rbx: buffer +# r14: output file handle +# returns number of bytes written in rax +:write + 4C89F9 ; COPY_R15_to_RCX # arg1 = fout + 52 ; PUSH_RDX # set size + 4889E2 ; COPY_RSP_to_RDX # arg2 = &size + 4989D8 ; COPY_RBX_to_R8 # arg3 = buffer + 4883EC 18 ; SUBI8_RSP !24 # allocate shadow stack space for UEFI + FF51 28 ; CALL_RCX_Immediate8 !40 # fin->write() + 4883C4 18 ; ADDI8_RSP !24 # deallocate stack + 58 ; POP_RAX # save size to rax + C3 ; RET + + +# Protocol GUIDs +:LOADED_IMAGE_PROTOCOL + A1 31 1B 5B ; %0x5b1b31a1 + 62 95 ; @0x9562 + D2 11 ; @0x11d2 +:LOADED_IMAGE_PROTOCOL_8 + 8E 3F 00 A0 C9 69 72 3B ; !0x8e !0x3f !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b + +:SIMPLE_FS_PROTOCOL + 22 5B 4E 96 ; %0x0964e5b22 + 59 64 ; @0x6459 + D2 11 ; @0x11d2 +:SIMPLE_FS_PROTOCOL_8 + 8E 39 00 A0 C9 69 72 3B ; !0x8e !0x39 !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b + +:rootdir + 00000000 00000000 + +:PE32_end diff --git a/amd64/mescc-tools-mini-kaem.kaem b/amd64/mescc-tools-mini-kaem.kaem index 00fd6d2..41340a7 100644 --- a/amd64/mescc-tools-mini-kaem.kaem +++ b/amd64/mescc-tools-mini-kaem.kaem @@ -19,3 +19,10 @@ amd64\artifact\hex1.efi amd64\hex2.hex1 amd64\artifact\hex2-0.efi # to function as an effective linker for later stages of the bootstrap # This is a minimal version which will be used to bootstrap a much more advanced # version in a later stage. + +################################# +# Phase-2b Build catm from hex2 # +################################# +amd64\artifact\hex2-0.efi amd64\catm.hex2 amd64\artifact\catm.efi +# catm removes the need for cat or shell support for redirection by providing +# equivalent functionality via catm output_file input1 input2 ... inputN