Igalia/pflua — pull request #12 by dpino (2014-07-21 15:39:29+00:00)
Title: Implement operators 'atalk' and 'aarp'

I have some doubts with this one. Both functions have a similar structure. Here is the BPF code and Lua code for each function:

>> atalk

BPF code:

(000) ldh [12]
(001) jeq #0x809b jt 7 jf 2
(002) jgt #0x5dc jt 8 jf 3
(003) ld [18]
(004) jeq #0x7809b jt 5 jf 8
(005) ld [14]
(006) jeq #0xaaaa0308 jt 7 jf 8
(007) ret #65535
(008) ret #0

Lua code:

return function(P,length)
if not (20 <= length) then return false end
local v1 = ffi.cast("uint16_t*", P+12)[0]
if v1 == 39808 then goto L1 end
do
local v2 = bit.rshift(bit.bswap(v1), 16)
if not (v2 > 1500) then return false end
end
::L1::
do
if not (v1 == 8) then return false end
local v3 = ffi.cast("uint16_t*", P+18)[0]
if not (v3 == 2424) then return false end
do
local v4 = ffi.cast("int32_t*", P+14)[0]
do return v4 == 134458026 end
end
end
end

>> aarp

BPF code:

(000) ldh [12]
(001) jeq #0x80f3 jt 7 jf 2
(002) jgt #0x5dc jt 8 jf 3
(003) ld [18]
(004) jeq #0x80f3 jt 5 jf 8
(005) ld [14]
(006) jeq #0xaaaa0300 jt 7 jf 8
(007) ret #65535
(008) ret #0

Lua code:

return function(P,length)
if not (20 <= length) then return false end
local v1 = ffi.cast("uint16_t*", P+12)[0]
if v1 == 62336 then goto L1 end
do
local v2 = bit.rshift(bit.bswap(v1), 16)
if not (v2 > 1500) then return false end
end
::L1::
do
if not (v1 == 8) then return false end
local v3 = ffi.cast("uint16_t*", P+18)[0]
if not (v3 == 29568) then return false end
do
local v4 = ffi.cast("int32_t*", P+14)[0]
do return v4 == 240298 end
end
end
end