dsasm_functions.cpp

Pvdasm.v1.04b反汇编程序的源代码.供研究反汇编技术的朋友参考

            else // UNKNOWN SEG (NOT IN RANGE 0-5)
            {
                if(d==0) // (->) Direction
                {                
                    wsprintf(assembly,"%s %s, SEG ??",instruction,regs[RM][reg1]);
                }
                else //(<-) Direction
                {
                    wsprintf(assembly,"%s SEG ??,%s",instruction,regs[RM][reg1]);
                }

                // Put warning
                lstrcat((*Disasm)->Remarks,"Unknown Segment Used,");
            }
            
            // Add data to the Struct
            (*Disasm)->OpcodeSize=2; // Instruction Size
            lstrcat((*Disasm)->Assembly,assembly);
            lstrcat((*Disasm)->Opcode,m_Bytes); 
            
            // Segment Modification Opcode ( MOV <SEG>, <REG>)
            if(Op==0x8E) 
                lstrcat((*Disasm)->Remarks,"Segment Is Being Modified!");
            
            (*(*index))++;

            return;
        }

		if(Op==0xC6)
		{
			RM=REG8;
			if(m_Opcode>=0xC0 && m_Opcode<=0xC7)
			{
				reg1=(m_Opcode&0x07); // Get Destination Register
				SwapWord((BYTE*)(*Opcode+Pos+1),&wOp,&wMem);
				// Read imm16
				wsprintf(temp,"%02X",*((BYTE*)(*Opcode+Pos+2)));
				wsprintf(m_Bytes,"C6 %04X",wOp);
				// Read Opcodes: Opcode - imm16                   
				m_OpcodeSize=3; // Instruction Size
				(*(*index))+=2;
				wsprintf(assembly,"%s %s, %s","mov",regs[RM][reg1],temp);
			}
			else
			{
				SwapWord((BYTE*)(*Opcode+Pos+1),&wOp,&wMem);
				wsprintf(m_Bytes,"C6 %04X",wOp);
				m_OpcodeSize=3;
				(*(*index))+=2;
				lstrcpy(assembly,"???");
			}
			lstrcat((*Disasm)->Assembly,assembly);
			(*Disasm)->OpcodeSize=m_OpcodeSize;
			lstrcat((*Disasm)->Opcode,m_Bytes);
			return;
		}

        // Mixed Instructions
        if(Op==0xC0 || Op==0xC1)
        {
            // Check register Size
            if(w==0) 
                RM=REG8;
            else
            {
                if(PrefixReg==1)
                    RM=REG16;
                else
                    RM=REG32;
            }       

            reg1=(m_Opcode&7); // Get Destination Register
            SwapWord((BYTE*)(*Opcode+Pos+1),&wOp,&wMem);
            wsprintf(temp,"%02X",wOp&0x00FF);            
            // Read Opcodes: Opcode - imm8
            wsprintf(m_Bytes,"%02X%04X",Op,wOp);
            m_OpcodeSize=3;
            (*(*index))+=2; // Prepare to read next Instruction
            // Build assembly
            wsprintf(assembly,"%s %s, %s",ArtimaticInstructions[REG],regs[RM][reg1],temp);
            lstrcat((*Disasm)->Assembly,assembly);
            (*Disasm)->OpcodeSize=m_OpcodeSize;
            lstrcat((*Disasm)->Opcode,m_Bytes);
            return; // exit the function
        }

        // XCHG Register
        if(Op>=0x91 && Op<=0x97) 
        {
            m_Opcode=(*(*Opcode+Pos)); // 1 byte Opcode
            m_Opcode+=0x30;            // Add 0x30 in order to get values of EAX-EDI (trick)
            IndexAdd=0;                // Dont Add to the index counter.
            m_OpcodeSize=1;            // 1 byte opcode          
        }

        // (->) / reg8
        if(d==0 && w==0)
        {    
            RM=REG8;
            reg1=(m_Opcode&0x07);
            reg2=(m_Opcode&0x38)>>3;
        }
        
        // (->) / reg32
        if(d==0 && w==1)
        {    
            RM=REG32;
            if(PrefixReg==1)
                RM=REG16; // (->) / reg16 (RegPerfix is being used)

            reg1=(m_Opcode&0x07);
            reg2=(m_Opcode&0x38)>>3;
        }
        
        // (<-) / reg8
        if(d==1 && w==0)
        {    
            RM=REG8;
            reg2=(m_Opcode&0x07);
            reg1=(m_Opcode&0x38)>>3;
        }
        
        // (<-) / reg32
        if(d==1 && w==1)
        {    
            RM=REG32;
            if(PrefixReg==1)
                RM=REG16; // (<-) / reg16

           reg2=(m_Opcode&0x07);
           reg1=(m_Opcode&0x38)>>3;
        }
        
        // Check Opcode Size (XCHG changes it)
       if(m_OpcodeSize==1)
       {
           wsprintf(temp,"%02X",Op);
       }
       else // Default
       {   
           SwapWord((BYTE*)(*Opcode+Pos),&wOp,&wMem);
           wsprintf(temp,"%04X",wOp);
       }       

       switch(Op) 
       {
         case 0x6B: // IMUL REG,REG,IIM
         {
             SwapWord((BYTE*)(*Opcode+Pos+1),&wOp,&wMem);
             FOpcode=wOp&0x00FF;

             if(FOpcode>0x7F) // check for signed numbers!!
             {
                 FOpcode = 0x100-FOpcode; // -XX (Signed)
                 wsprintf(temp,"%s",Scale[0]); // '-' aritmathic (Signed)                            
             }
             else                    
                strcpy(temp,"");

             m_OpcodeSize=3;
             (*(*index))++;
             wsprintf(assembly,"imul %s,%s,%s%02X",regs[RM][reg1],regs[RM][reg2],temp,FOpcode);
             wsprintf(temp,"%02X%04X",Op,wOp);
         }
         break;
           
         case 0x8F: // POP REG
         {
           if((BYTE)(*(*Opcode+Pos+1))>=0xC8) // above bytes has !=000 there for invalid
              lstrcat((*Disasm)->Remarks,"Invalid Instruction");
                 
           wsprintf(assembly,"%s %s",instruction,regs[RM][reg2]);
         }
         break;

         case 0xD0: case 0xD1: 
         {
             wsprintf(assembly,"%s %s, 1",ArtimaticInstructions[REG],regs[RM][reg1]);
         }
         break;

         case 0xD2: case 0xD3: 
         {
             wsprintf(assembly,"%s %s, cl",ArtimaticInstructions[REG],regs[RM][reg2]);
         }
         break;

         case 0xD8:// FPU Instruction
         {
             if(REG==3) // fcomp uses 1 operand
             {
                 wsprintf(assembly,"%s %s",FpuInstructions[REG],FpuRegs[reg1]);
             }
             else // st(0) is the dest
             {
                 wsprintf(assembly,"%s st,%s",FpuInstructions[REG],FpuRegs[reg1]);
             }
         }
         break;
         
         case 0xD9: // FPU Instructions
         {
             // 2 byte FPU Instructions
             switch((BYTE)(*(*Opcode+Pos+1)))
             {
                case 0xC8:case 0xC9:case 0xCA:case 0xCB:
                case 0xCC:case 0xCD:case 0xCE:case 0xCF:
                {
                    wsprintf(assembly,"fxch %s",FpuRegs[reg1]);
                }
                break;
                
                case 0xD1:case 0xD2:case 0xD3:case 0xD4:
                case 0xD5:case 0xD6:case 0xD7:
                {
                   wsprintf(assembly,"fst %s",FpuRegs[reg1]);
                }
                break;

                case 0xD8:case 0xD9:case 0xDA:case 0xDB:
                case 0xDC:case 0xDD:case 0xDE:case 0xDF:
                {
                   wsprintf(assembly,"fstp %s",FpuRegs[reg1]);
                }
                break;

                case 0xE2:case 0xE3:case 0xE6:case 0xE7:
                {
                   wsprintf(assembly,"fldenv %s",FpuRegs[reg1]);
                }
                break;

                case 0xEF:
                {
                   wsprintf(assembly,"fldcw %s",FpuRegs[reg1]);
                }
                break;

                case 0xC0:case 0xC1:case 0xC2:case 0xC3:case 0xC4:
				case 0xC5:case 0xC6:case 0xC7:
				{
					wsprintf(assembly,"fld %s",FpuRegs[reg1]);
				}
                break;
					
                case 0xD0: strcpy(assembly,"fnop");    break;
                case 0xE0: strcpy(assembly,"fchs");    break;
                case 0xE1: strcpy(assembly,"fabs");    break;
                case 0xE4: strcpy(assembly,"ftst");    break;
                case 0xE5: strcpy(assembly,"fxam");    break;
                case 0xE8: strcpy(assembly,"fld1