disasm.c

Fenris是一个检测并把高层次的语言结构做成文档的多功能故障检测器、调试器、代码分析工具。它能回复符号

	    ins->oprs[c-070].offset = *data++;
	    ins->oprs[c-070].offset |= (*data++ << 8);
	    ins->oprs[c-070].offset |= (((long) *data++) << 16);
	    ins->oprs[c-070].offset |= (((long) *data++) << 24);
	    ins->oprs[c-070].segment |= SEG_32BIT | SEG_RELATIVE;
	}
	if (c >= 0100 && c < 0130) {
	    int modrm = *data++;
	    ins->oprs[c & 07].basereg = (modrm >> 3) & 07;
	    ins->oprs[c & 07].segment |= SEG_RMREG;
	    data = do_ea (data, modrm, asize, segsize,
			  &ins->oprs[(c >> 3) & 07]);
	}
	if (c >= 0130 && c <= 0132) {
	    ins->oprs[c-0130].offset = *data++;
	    ins->oprs[c-0130].offset |= (*data++ << 8);
	}
	if (c >= 0140 && c <= 0142) {
	    ins->oprs[c-0140].offset = *data++;
	    ins->oprs[c-0140].offset |= (*data++ << 8);
	    ins->oprs[c-0140].offset |= (((long) *data++) << 16);
	    ins->oprs[c-0140].offset |= (((long) *data++) << 24);
	}
	if (c >= 0200 && c <= 0277) {
	    int modrm = *data++;
	    if (((modrm >> 3) & 07) != (c & 07))
		return FALSE;	       /* spare field doesn't match up */
	    data = do_ea (data, modrm, asize, segsize,
			  &ins->oprs[(c >> 3) & 07]);
	}
	if (c >= 0300 && c <= 0302) {
	    if (asize)
		ins->oprs[c-0300].segment |= SEG_32BIT;
	    else
		ins->oprs[c-0300].segment &= ~SEG_32BIT;
	    a_used = TRUE;
	}
	if (c == 0310) {
	    if (asize == 32)
		return FALSE;
	    else
		a_used = TRUE;
	}
	if (c == 0311) {
	    if (asize == 16)
		return FALSE;
	    else
		a_used = TRUE;
	}
	if (c == 0312) {
	    if (asize != segsize)
		return FALSE;
	    else
		a_used = TRUE;
	}
	if (c == 0320) {
	    if (osize == 32)
		return FALSE;
	    else
		o_used = TRUE;
	}
	if (c == 0321) {
	    if (osize == 16)
		return FALSE;
	    else
		o_used = TRUE;
	}
	if (c == 0322) {
	    if (osize != segsize)
		return FALSE;
	    else
		o_used = TRUE;
	}
	if (c == 0330) {
	    int t = *r++, d = *data++;
	    if (d < t || d > t+15)
		return FALSE;
	    else
		ins->condition = d - t;
	}
	if (c == 0331) {
	    if ( rep )
	        return FALSE;
	}
	if (c == 0332) {
	    if (drep == P_REP)
	        drep = P_REPE;
	}
	if (c == 0333) {
	    if ( rep != 0xF3 )
	        return FALSE;
	    drep = 0;
	}
    }

    /*
     * Check for unused rep or a/o prefixes.
     */
    ins->nprefix = 0;
    if (drep)
        ins->prefixes[ins->nprefix++] = drep;
    if (!a_used && asize != segsize)
	ins->prefixes[ins->nprefix++] = (asize == 16 ? P_A16 : P_A32);
    if (!o_used && osize != segsize)
	ins->prefixes[ins->nprefix++] = (osize == 16 ? P_O16 : P_O32);

    return data - origdata;
}

long disasm (unsigned char *data, char *output, int segsize, long offset,
	     int autosync, unsigned long prefer)
{
    struct itemplate **p, **best_p;
    int length, best_length = 0;
    char *segover;
    int rep, lock, asize, osize, i, slen, colon;
    unsigned char *origdata;
    int works;
    insn tmp_ins, ins;
    unsigned long goodness, best;

    /*
     * Scan for prefixes.
     */
    asize = osize = segsize;
    segover = NULL;
    rep = lock = 0;
    origdata = data;
    for (;;) {
	if (*data == 0xF3 || *data == 0xF2)
	    rep = *data++;
	else if (*data == 0xF0)
	    lock = *data++;
	else if (*data == 0x2E || *data == 0x36 || *data == 0x3E ||
		 *data == 0x26 || *data == 0x64 || *data == 0x65) {
	    switch (*data++) {
	      case 0x2E: segover = "cs"; break;
	      case 0x36: segover = "ss"; break;
	      case 0x3E: segover = "ds"; break;
	      case 0x26: segover = "es"; break;
	      case 0x64: segover = "fs"; break;
	      case 0x65: segover = "gs"; break;
	    }
	} else if (*data == 0x66)
	    osize = 48 - segsize, data++;
	else if (*data == 0x67)
	    asize = 48 - segsize, data++;
	else
	    break;
    }

    tmp_ins.oprs[0].segment = tmp_ins.oprs[1].segment =
    tmp_ins.oprs[2].segment =
    tmp_ins.oprs[0].addr_size = tmp_ins.oprs[1].addr_size =
      tmp_ins.oprs[2].addr_size = (segsize == 16 ? 0 : SEG_32BIT);
    tmp_ins.condition = -1;
    best = ~0UL;		/* Worst possible */
    best_p = NULL;
    for (p = itable[*data]; *p; p++) {
      if ( (length = matches(*p, data, asize, osize,
			     segsize, rep, &tmp_ins)) ) {
	works = TRUE;
	/*
	 * Final check to make sure the types of r/m match up.
	 */
	for (i = 0; i < (*p)->operands; i++) {
	  if (
	      /* If it's a mem-only EA but we have a register, die. */
	      ((tmp_ins.oprs[i].segment & SEG_RMREG) &&
	       !(MEMORY & ~(*p)->opd[i])) ||
	      
	      /* If it's a reg-only EA but we have a memory ref, die. */
	      (!(tmp_ins.oprs[i].segment & SEG_RMREG) &&
	       !(REGNORM & ~(*p)->opd[i]) &&
	       !((*p)->opd[i] & REG_SMASK)) ||
	      
	      /* Register type mismatch (eg FS vs REG_DESS): die. */
	      ((((*p)->opd[i] & (REGISTER | FPUREG)) ||
		(tmp_ins.oprs[i].segment & SEG_RMREG)) &&
	       !whichreg ((*p)->opd[i], tmp_ins.oprs[i].basereg))) {
	    works = FALSE;
	    break;
	  }
	}  
	
	if (works) {
	  goodness = ((*p)->flags & IF_PFMASK) ^ prefer;
	  if ( goodness < best ) {
	    /* This is the best one found so far */
	    best        = goodness;
	    best_p      = p;
	    best_length = length;
	    ins         = tmp_ins;
	  }
	}
      }
    }

    if (!best_p)
	return 0;		       /* no instruction was matched */

    /* Pick the best match */
    p      = best_p;
    length = best_length;

    slen = 0;

    if (lock)
	slen += sprintf(output+slen, "lock ");
    for (i = 0; i < ins.nprefix; i++)
	switch (ins.prefixes[i]) {
	  case P_REP:   slen += sprintf(output+slen, "rep "); break;
	  case P_REPE:  slen += sprintf(output+slen, "repe "); break;
	  case P_REPNE: slen += sprintf(output+slen, "repne "); break;
	  case P_A16:   slen += sprintf(output+slen, "a16 "); break;
	  case P_A32:   slen += sprintf(output+slen, "a32 "); break;
	  case P_O16:   slen += sprintf(output+slen, "o16 "); break;
	  case P_O32:   slen += sprintf(output+slen, "o32 "); break;
	}

    for (i = 0; i < elements(ico); i++)
	if ((*p)->opcode == ico[i]) {
	    slen += sprintf(output+slen, "%s%s", icn[i],
			    whichcond(ins.condition));
	    break;
	}
    if (i >= elements(ico))
	slen += sprintf(output+slen, "%s", insn_names[(*p)->opcode]);
    colon = FALSE;
    length += data - origdata;	       /* fix up for prefixes */
    for (i=0; i<(*p)->operands; i++) {
	output[slen++] = (colon ? ':' : i==0 ? ' ' : ',');

	if (ins.oprs[i].segment & SEG_RELATIVE) {
	    ins.oprs[i].offset += offset + length;
	    /*
	     * sort out wraparound
	     */
	    if (!(ins.oprs[i].segment & SEG_32BIT))
		ins.oprs[i].offset &= 0xFFFF;
	    /*
	     * add sync marker, if autosync is on
	     */
	    if (autosync)
		add_sync (ins.oprs[i].offset, 0L);
	}

	if ((*p)->opd[i] & COLON)
	    colon = TRUE;
	else
	    colon = FALSE;

	if (((*p)->opd[i] & (REGISTER | FPUREG)) ||
	    (ins.oprs[i].segment & SEG_RMREG)) 
	{
	    ins.oprs[i].basereg = whichreg ((*p)->opd[i],
					    ins.oprs[i].basereg);
	    if ( (*p)->opd[i] & TO )
		slen += sprintf(output+slen, "to ");
	    slen += sprintf(output+slen, "%s",
			    reg_names[ins.oprs[i].basereg-EXPR_REG_START]);
	} else if (!(UNITY & ~(*p)->opd[i])) {
	    output[slen++] = '1';
	} else if ( (*p)->opd[i] & IMMEDIATE ) {
	    if ( (*p)->opd[i] & BITS8 ) {
		slen += sprintf(output+slen, "byte ");
		if (ins.oprs[i].segment & SEG_SIGNED) {
		    if (ins.oprs[i].offset < 0) {
			ins.oprs[i].offset *= -1;
			output[slen++] = '-';
		    } else
			output[slen++] = '+';
		}
	    } else if ( (*p)->opd[i] & BITS16 ) {
		slen += sprintf(output+slen, "word ");
	    } else if ( (*p)->opd[i] & BITS32 ) {
		slen += sprintf(output+slen, "dword ");
	    } else if ( (*p)->opd[i] & NEAR ) {
		slen += sprintf(output+slen, "near ");
	    } else if ( (*p)->opd[i] & SHORT ) {
		slen += sprintf(output+slen, "short ");
	    }
	    slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
	} else if ( !(MEM_OFFS & ~(*p)->opd[i]) ) {
	    slen += sprintf(output+slen, "[%s%s%s0x%lx]",
			    (segover ? segover : ""),
			    (segover ? ":" : ""),
			    (ins.oprs[i].addr_size == 32 ? "dword " :
			     ins.oprs[i].addr_size == 16 ? "word " : ""),
			    ins.oprs[i].offset);
	    segover = NULL;
	} else if ( !(REGMEM & ~(*p)->opd[i]) ) {
	    int started = FALSE;
	    if ( (*p)->opd[i] & BITS8 )
		slen += sprintf(output+slen, "byte ");
	    if ( (*p)->opd[i] & BITS16 )
		slen += sprintf(output+slen, "word ");
	    if ( (*p)->opd[i] & BITS32 )
		slen += sprintf(output+slen, "dword ");
	    if ( (*p)->opd[i] & BITS64 )
		slen += sprintf(output+slen, "qword ");
	    if ( (*p)->opd[i] & BITS80 )
		slen += sprintf(output+slen, "tword ");
	    if ( (*p)->opd[i] & FAR )
		slen += sprintf(output+slen, "far ");
	    if ( (*p)->opd[i] & NEAR )
		slen += sprintf(output+slen, "near ");
	    output[slen++] = '[';
	    if (ins.oprs[i].addr_size)
		slen += sprintf(output+slen, "%s",
				(ins.oprs[i].addr_size == 32 ? "dword " :
				 ins.oprs[i].addr_size == 16 ? "word " : ""));
	    if (segover) {
		slen += sprintf(output+slen, "%s:", segover);
		segover = NULL;
	    }
	    if (ins.oprs[i].basereg != -1) {
		slen += sprintf(output+slen, "%s",
				reg_names[(ins.oprs[i].basereg -
					   EXPR_REG_START)]);
		started = TRUE;
	    }
	    if (ins.oprs[i].indexreg != -1) {
		if (started)
		    output[slen++] = '+';
		slen += sprintf(output+slen, "%s",
				reg_names[(ins.oprs[i].indexreg -
					   EXPR_REG_START)]);
		if (ins.oprs[i].scale > 1)
		    slen += sprintf(output+slen, "*%d", ins.oprs[i].scale);
		started = TRUE;
	    }
	    if (ins.oprs[i].segment & SEG_DISP8) {
		int sign = '+';
		if (ins.oprs[i].offset & 0x80) {
		    ins.oprs[i].offset = - (signed char) ins.oprs[i].offset;
		    sign = '-';
		}
		slen += sprintf(output+slen, "%c0x%lx", sign,
				ins.oprs[i].offset);
	    } else if (ins.oprs[i].segment & SEG_DISP16) {
		if (started)
		    output[slen++] = '+';
		slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
	    } else if (ins.oprs[i].segment & SEG_DISP32) {
		if (started)
		    output[slen++] = '+';
		slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
	    }
	    output[slen++] = ']';
	} else {
	    slen += sprintf(output+slen, "<operand%d>", i);
	}
    }
    output[slen] = '\0';
    if (segover) {		       /* unused segment override */
	char *p = output;
	int count = slen+1;
	while (count--)
	    p[count+3] = p[count];
	strncpy (output, segover, 2);
	output[2] = ' ';
    }
    return length;
}

long eatbyte (unsigned char *data, char *output) 
{
    sprintf(output, "db 0x%02X", *data);
    return 1;
}