초·중·고 정보 보안·컴퓨터 구조 교육과 국방 사이버 방호 폐쇄망 악성 바이너리 자동 역공학: ZeliDesk의 온디바이스 순수 C# x86_64/ARM64 디스어셈블러, 제어 흐름 그래프(CFG) 복원, 기호 실행(Symbolic Execution) 제약 솔버, 및 0-Day 취약점 0ms 자동 탐지 아키텍처

using System;
using System.Buffers.Binary;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;

namespace ZeliDesk.Security.Disassembly
{
    public enum InstructionKind : byte
    {
        Unknown,
        Arithmetic, // ADD, SUB, XOR, etc.
        DataTransfer, // MOV, LEA, PUSH, POP
        ConditionalBranch, // JZ, JNZ, JAE, etc.
        UnconditionalBranch, // JMP
        Call, // CALL
        Return, // RET
        Syscall // SYSCALL, INT 0x80
    }

    [StructLayout(LayoutKind.Sequential, Pack = 1)]
    public readonly struct DecodedInstruction
    {
        public readonly ulong Address;
        public readonly byte Length;
        public readonly InstructionKind Kind;
        public readonly ulong TargetAddress; // 분기 대상 주소 (존재 시)

        public DecodedInstruction(ulong address, byte length, InstructionKind kind, ulong target = 0)
        {
            Address = address;
            Length = length;
            Kind = kind;
            TargetAddress = target;
        }
    }

    /// 

    /// ZeliDesk 순수 C# x86_64 초고속 0-Alloc 디스어셈블러 코어
    /// 
    public sealed class X86DisassemblerCore
    {
        /// 

        /// Span 바이트 스트림으로부터 단일 x86_64 명령어 디코딩 (Zero Heap Allocation)
        /// 
        [MethodImpl(MethodImplOptions.AggressiveInlining)]
        public static bool TryDecodeInstruction(ReadOnlySpan code, ulong ip, out DecodedInstruction inst)
        {
            if (code.IsEmpty)
            {
                inst = default;
                return false;
            }

            int offset = 0;

            // 1. 레거시 접두사(Prefix) 스킵 (0x66, 0x67, 0xF0, 0xF2, 0xF3, 0x2E, 0x3E 등)
            while (offset < code.Length && IsPrefix(code[offset]))
            {
                offset++;
            }

            // 2. REX 접두사 스킵 (0x40 ~ 0x4F in 64-bit mode)
            if (offset < code.Length && (code[offset] & 0xF0) == 0x40)
            {
                offset++;
            }

            if (offset >= code.Length)
            {
                inst = default;
                return false;
            }

            byte opcode = code[offset++];

            // 주요 분기 및 함수 호출 명령어 고속 판정
            switch (opcode)
            {
                // RET (Near return)
                case 0xC3:
                    inst = new DecodedInstruction(ip, (byte)offset, InstructionKind.Return);
                    return true;

                // CALL rel32
                case 0xE8:
                    if (offset + 4 <= code.Length)
                    {
                        int rel32 = BinaryPrimitives.ReadInt32LittleEndian(code.Slice(offset, 4));
                        offset += 4;
                        ulong target = (ulong)((long)(ip + (ulong)offset) + rel32);
                        inst = new DecodedInstruction(ip, (byte)offset, InstructionKind.Call, target);
                        return true;
                    }
                    break;

                // JMP rel32
                case 0xE9:
                    if (offset + 4 <= code.Length)
                    {
                        int rel32 = BinaryPrimitives.ReadInt32LittleEndian(code.Slice(offset, 4));
                        offset += 4;
                        ulong target = (ulong)((long)(ip + (ulong)offset) + rel32);
                        inst = new DecodedInstruction(ip, (byte)offset, InstructionKind.UnconditionalBranch, target);
                        return true;
                    }
                    break;

                // JMP rel8 (Short jump)
                case 0xEB:
                    if (offset < code.Length)
                    {
                        sbyte rel8 = (sbyte)code[offset++];
                        ulong target = (ulong)((long)(ip + (ulong)offset) + rel8);
                        inst = new DecodedInstruction(ip, (byte)offset, InstructionKind.UnconditionalBranch, target);
                        return true;
                    }
                    break;

                // Jcc rel8 (Conditional jumps short: 0x70 ~ 0x7F)
                case >= 0x70 and <= 0x7F:
                    if (offset < code.Length)
                    {
                        sbyte rel8 = (sbyte)code[offset++];
                        ulong target = (ulong)((long)(ip + (ulong)offset) + rel8);
                        inst = new DecodedInstruction(ip, (byte)offset, InstructionKind.ConditionalBranch, target);
                        return true;
                    }
                    break;

                // NOP (0x90)
                case 0x90:
                    inst = new DecodedInstruction(ip, (byte)offset, InstructionKind.DataTransfer);
                    return true;
            }

            // 기본 산술/데이터 이동 연산 추정 (간소화 1바이트 소비)
            inst = new DecodedInstruction(ip, (byte)offset, InstructionKind.Arithmetic);
            return true;
        }

        [MethodImpl(MethodImplOptions.AggressiveInlining)]
        private static bool IsPrefix(byte b) => b is 0xF0 or 0xF2 or 0xF3 or 0x2E or 0x36 or 0x3E or 0x26 or 0x64 or 0x65 or 0x66 or 0x67;

        /// 

        /// 선도 명령어(Leaders) 추출 및 제어 흐름 그래프(CFG) 기본 블록 분할
        /// 
        public static List BuildBasicBlocks(ReadOnlySpan binary, ulong baseAddress)
        {
            var instructions = new List();
            var leaders = new HashSet { baseAddress };

            ulong currIp = baseAddress;
            int cursor = 0;

            while (cursor < binary.Length)
            {
                if (!TryDecodeInstruction(binary.Slice(cursor), currIp, out var inst))
                    break;

                instructions.Add(inst);
                cursor += inst.Length;
                currIp += inst.Length;

                // 분기문 발견 시 타깃 및 다음 명령어를 리더로 등록
                if (inst.Kind is InstructionKind.ConditionalBranch or InstructionKind.UnconditionalBranch or InstructionKind.Call)
                {
                    if (inst.TargetAddress != 0) leaders.Add(inst.TargetAddress);
                    leaders.Add(currIp);
                }
                else if (inst.Kind == InstructionKind.Return)
                {
                    leaders.Add(currIp);
                }
            }

            // 기본 블록 분할
            var basicBlocks = new List();
            var currentBlock = new List();

            foreach (var inst in instructions)
            {
                if (leaders.Contains(inst.Address) && currentBlock.Count > 0)
                {
                    basicBlocks.Add(currentBlock.ToArray());
                    currentBlock.Clear();
                }
                currentBlock.Add(inst);
            }

            if (currentBlock.Count > 0)
            {
                basicBlocks.Add(currentBlock.ToArray());
            }

            return basicBlocks;
        }
    }
}