📄 disasm.c
字号:
}
if (c >= 070 && c <= 072) {
ins->oprs[c-070].offset = *data++;
ins->oprs[c-070].offset |= (((unsigned) *data++) << 8);
ins->oprs[c-070].offset |= (((long) *data++) << 16);
ins->oprs[c-070].offset |= (((long) *data++) << 24);
ins->oprs[c-070].segment |= SEG_32BIT | SEG_RELATIVE;
}
if (c >= 0100 && c < 0130) {
int modrm = *data++;
ins->oprs[c & 07].basereg = (modrm >> 3) & 07;
ins->oprs[c & 07].segment |= SEG_RMREG;
data = do_ea (data, modrm, asize, segsize,
&ins->oprs[(c >> 3) & 07]);
}
if (c >= 0130 && c <= 0132) {
ins->oprs[c-0130].offset = *data++;
ins->oprs[c-0130].offset |= (((unsigned) *data++) << 8);
}
if (c >= 0140 && c <= 0142) {
ins->oprs[c-0140].offset = *data++;
ins->oprs[c-0140].offset |= (((unsigned) *data++) << 8);
ins->oprs[c-0140].offset |= (((long) *data++) << 16);
ins->oprs[c-0140].offset |= (((long) *data++) << 24);
}
if (c >= 0200 && c <= 0277) {
int modrm = *data++;
if (((modrm >> 3) & 07) != (c & 07))
return FALSE; /* spare field doesn't match up */
data = do_ea (data, modrm, asize, segsize,
&ins->oprs[(c >> 3) & 07]);
}
if (c >= 0300 && c <= 0302) {
if (asize)
ins->oprs[c-0300].segment |= SEG_32BIT;
else
ins->oprs[c-0300].segment &= ~SEG_32BIT;
a_used = TRUE;
}
if (c == 0310) {
if (asize == 32)
return FALSE;
else
a_used = TRUE;
}
if (c == 0311) {
if (asize == 16)
return FALSE;
else
a_used = TRUE;
}
if (c == 0312) {
if (asize != segsize)
return FALSE;
else
a_used = TRUE;
}
if (c == 0320) {
if (osize == 32)
return FALSE;
else
o_used = TRUE;
}
if (c == 0321) {
if (osize == 16)
return FALSE;
else
o_used = TRUE;
}
if (c == 0322) {
if (osize != segsize)
return FALSE;
else
o_used = TRUE;
}
if (c == 0330) {
int t = *r++, d = *data++;
if (d < t || d > t+15)
return FALSE;
else
ins->condition = d - t;
}
if (c == 0331) {
if ( rep )
return FALSE;
}
if (c == 0332) {
if (drep == P_REP)
drep = P_REPE;
}
if (c == 0333) {
if ( rep != 0xF3 )
return FALSE;
drep = 0;
}
}
/*
* Check for unused rep or a/o prefixes.
*/
ins->nprefix = 0;
if (drep)
ins->prefixes[ins->nprefix++] = drep;
if (!a_used && asize != segsize)
ins->prefixes[ins->nprefix++] = (asize == 16 ? P_A16 : P_A32);
if (!o_used && osize != segsize)
ins->prefixes[ins->nprefix++] = (osize == 16 ? P_O16 : P_O32);
return data - origdata;
}
long disasm (unsigned char *data, char *output, int segsize, long offset,
int autosync, unsigned long prefer)
{
struct itemplate **p, **best_p;
int length, best_length = 0;
char *segover;
int rep, lock, asize, osize, i, slen, colon;
unsigned char *origdata;
int works;
insn tmp_ins, ins;
unsigned long goodness, best;
/*
* Scan for prefixes.
*/
asize = osize = segsize;
segover = NULL;
rep = lock = 0;
origdata = data;
for (;;) {
if (*data == 0xF3 || *data == 0xF2)
rep = *data++;
else if (*data == 0xF0)
lock = *data++;
else if (*data == 0x2E || *data == 0x36 || *data == 0x3E ||
*data == 0x26 || *data == 0x64 || *data == 0x65) {
switch (*data++) {
case 0x2E: segover = "cs"; break;
case 0x36: segover = "ss"; break;
case 0x3E: segover = "ds"; break;
case 0x26: segover = "es"; break;
case 0x64: segover = "fs"; break;
case 0x65: segover = "gs"; break;
}
} else if (*data == 0x66)
osize = 48 - segsize, data++;
else if (*data == 0x67)
asize = 48 - segsize, data++;
else
break;
}
tmp_ins.oprs[0].segment = tmp_ins.oprs[1].segment =
tmp_ins.oprs[2].segment =
tmp_ins.oprs[0].addr_size = tmp_ins.oprs[1].addr_size =
tmp_ins.oprs[2].addr_size = (segsize == 16 ? 0 : SEG_32BIT);
tmp_ins.condition = -1;
best = ~0UL; /* Worst possible */
best_p = NULL;
for (p = itable[*data]; *p; p++) {
if ( (length = matches(*p, data, asize, osize,
segsize, rep, &tmp_ins)) ) {
works = TRUE;
/*
* Final check to make sure the types of r/m match up.
*/
for (i = 0; i < (*p)->operands; i++) {
if (
/* If it's a mem-only EA but we have a register, die. */
((tmp_ins.oprs[i].segment & SEG_RMREG) &&
!(MEMORY & ~(*p)->opd[i])) ||
/* If it's a reg-only EA but we have a memory ref, die. */
(!(tmp_ins.oprs[i].segment & SEG_RMREG) &&
!(REGNORM & ~(*p)->opd[i]) &&
!((*p)->opd[i] & REG_SMASK)) ||
/* Register type mismatch (eg FS vs REG_DESS): die. */
((((*p)->opd[i] & (REGISTER | FPUREG)) ||
(tmp_ins.oprs[i].segment & SEG_RMREG)) &&
!whichreg ((*p)->opd[i], tmp_ins.oprs[i].basereg))) {
works = FALSE;
break;
}
}
if (works) {
goodness = ((*p)->flags & IF_PFMASK) ^ prefer;
if ( goodness < best ) {
/* This is the best one found so far */
best = goodness;
best_p = p;
best_length = length;
ins = tmp_ins;
}
}
}
}
if (!best_p)
return 0; /* no instruction was matched */
/* Pick the best match */
p = best_p;
length = best_length;
slen = 0;
if (lock)
slen += sprintf(output+slen, "lock ");
for (i = 0; i < ins.nprefix; i++)
switch (ins.prefixes[i]) {
case P_REP: slen += sprintf(output+slen, "rep "); break;
case P_REPE: slen += sprintf(output+slen, "repe "); break;
case P_REPNE: slen += sprintf(output+slen, "repne "); break;
case P_A16: slen += sprintf(output+slen, "a16 "); break;
case P_A32: slen += sprintf(output+slen, "a32 "); break;
case P_O16: slen += sprintf(output+slen, "o16 "); break;
case P_O32: slen += sprintf(output+slen, "o32 "); break;
}
for (i = 0; i < elements(ico); i++)
if ((*p)->opcode == ico[i]) {
slen += sprintf(output+slen, "%s%s", icn[i],
whichcond(ins.condition));
break;
}
if (i >= elements(ico))
slen += sprintf(output+slen, "%s", insn_names[(*p)->opcode]);
colon = FALSE;
length += data - origdata; /* fix up for prefixes */
for (i=0; i<(*p)->operands; i++) {
output[slen++] = (colon ? ':' : i==0 ? ' ' : ',');
if (ins.oprs[i].segment & SEG_RELATIVE) {
ins.oprs[i].offset += offset + length;
/*
* sort out wraparound
*/
if (!(ins.oprs[i].segment & SEG_32BIT))
ins.oprs[i].offset &= 0xFFFF;
/*
* add sync marker, if autosync is on
*/
if (autosync)
add_sync (ins.oprs[i].offset, 0L);
}
if ((*p)->opd[i] & COLON)
colon = TRUE;
else
colon = FALSE;
if (((*p)->opd[i] & (REGISTER | FPUREG)) ||
(ins.oprs[i].segment & SEG_RMREG))
{
ins.oprs[i].basereg = whichreg ((*p)->opd[i],
ins.oprs[i].basereg);
if ( (*p)->opd[i] & TO )
slen += sprintf(output+slen, "to ");
slen += sprintf(output+slen, "%s",
reg_names[ins.oprs[i].basereg-EXPR_REG_START]);
} else if (!(UNITY & ~(*p)->opd[i])) {
output[slen++] = '1';
} else if ( (*p)->opd[i] & IMMEDIATE ) {
if ( (*p)->opd[i] & BITS8 ) {
slen += sprintf(output+slen, "byte ");
if (ins.oprs[i].segment & SEG_SIGNED) {
if (ins.oprs[i].offset < 0) {
ins.oprs[i].offset *= -1;
output[slen++] = '-';
} else
output[slen++] = '+';
}
} else if ( (*p)->opd[i] & BITS16 ) {
slen += sprintf(output+slen, "word ");
} else if ( (*p)->opd[i] & BITS32 ) {
slen += sprintf(output+slen, "dword ");
} else if ( (*p)->opd[i] & NEAR ) {
slen += sprintf(output+slen, "near ");
} else if ( (*p)->opd[i] & SHORT ) {
slen += sprintf(output+slen, "short ");
}
slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
} else if ( !(MEM_OFFS & ~(*p)->opd[i]) ) {
slen += sprintf(output+slen, "[%s%s%s0x%lx]",
(segover ? segover : ""),
(segover ? ":" : ""),
(ins.oprs[i].addr_size == 32 ? "dword " :
ins.oprs[i].addr_size == 16 ? "word " : ""),
ins.oprs[i].offset);
segover = NULL;
} else if ( !(REGMEM & ~(*p)->opd[i]) ) {
int started = FALSE;
if ( (*p)->opd[i] & BITS8 )
slen += sprintf(output+slen, "byte ");
if ( (*p)->opd[i] & BITS16 )
slen += sprintf(output+slen, "word ");
if ( (*p)->opd[i] & BITS32 )
slen += sprintf(output+slen, "dword ");
if ( (*p)->opd[i] & BITS64 )
slen += sprintf(output+slen, "qword ");
if ( (*p)->opd[i] & BITS80 )
slen += sprintf(output+slen, "tword ");
if ( (*p)->opd[i] & FAR )
slen += sprintf(output+slen, "far ");
if ( (*p)->opd[i] & NEAR )
slen += sprintf(output+slen, "near ");
output[slen++] = '[';
if (ins.oprs[i].addr_size)
slen += sprintf(output+slen, "%s",
(ins.oprs[i].addr_size == 32 ? "dword " :
ins.oprs[i].addr_size == 16 ? "word " : ""));
if (segover) {
slen += sprintf(output+slen, "%s:", segover);
segover = NULL;
}
if (ins.oprs[i].basereg != -1) {
slen += sprintf(output+slen, "%s",
reg_names[(ins.oprs[i].basereg -
EXPR_REG_START)]);
started = TRUE;
}
if (ins.oprs[i].indexreg != -1) {
if (started)
output[slen++] = '+';
slen += sprintf(output+slen, "%s",
reg_names[(ins.oprs[i].indexreg -
EXPR_REG_START)]);
if (ins.oprs[i].scale > 1)
slen += sprintf(output+slen, "*%d", ins.oprs[i].scale);
started = TRUE;
}
if (ins.oprs[i].segment & SEG_DISP8) {
int sign = '+';
if (ins.oprs[i].offset & 0x80) {
ins.oprs[i].offset = - (signed char) ins.oprs[i].offset;
sign = '-';
}
slen += sprintf(output+slen, "%c0x%lx", sign,
ins.oprs[i].offset);
} else if (ins.oprs[i].segment & SEG_DISP16) {
if (started)
output[slen++] = '+';
slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
} else if (ins.oprs[i].segment & SEG_DISP32) {
if (started)
output[slen++] = '+';
slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
}
output[slen++] = ']';
} else {
slen += sprintf(output+slen, "<operand%d>", i);
}
}
output[slen] = '\0';
if (segover) { /* unused segment override */
char *p = output;
int count = slen+1;
while (count--)
p[count+3] = p[count];
strncpy (output, segover, 2);
output[2] = ' ';
}
return length;
}
long eatbyte (unsigned char *data, char *output)
{
sprintf(output, "db 0x%02X", *data);
return 1;
}
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -