disasm.pas

一款压缩壳PE123的DELPHI源码 学习写壳的很好的参考

unit disasm;

interface

const
NEGLIMIT = (-16384);        // Limit to display constans as signed
PSEUDOOP  =     128;             // Base for pseudooperands
TEXTLEN   =     255;             // Maximal length of text string

// Special command features.
WW      =       $01;            // Bit W (size of operand)
SS       =      $02;            // Bit S (sign extention of immediate)
WS        =     $03;            // Bits W and S
W3         =    $08;            // Bit W at position 3
CC        =     $10;            // Conditional jump
FF       =      $20;            // Forced 16-bit size
LL      =       $40;            // Conditional loop
PR     =        $80;            // Protected command
WP    =         $81;            // I/O command with bit W

// All possible types of operands in 80x86. A bit more than you expected, he?
NNN=           0;               // No operand
REG=            1;               // Integer register in Reg field
RCM=            2;               // Integer register in command byte
RG4 =           3;               // Integer 4-byte register in Reg field
RAC  =          4;               // Accumulator (AL/AX/EAX, implicit)
RAX   =         5;               // AX (2-byte, implicit)
RDX    =        6;               // DX (16-bit implicit port address)
RCL     =       7;               // Implicit CL register (for shifts)
RS0      =      8;               // Top of FPU stack (ST(0), implicit)
RST       =     9;               // FPU register (ST(i)) in command byte
RMX        =    10;              // MMX register MMx
R3D        =    11;              // 3DNow! register MMx
MRG        =    12;              // Memory/register in ModRM byte
MR1=            13;              // 1-byte memory/register in ModRM byte
MR2 =           14;              // 2-byte memory/register in ModRM byte
MR4  =          15;              // 4-byte memory/register in ModRM byte
RR4   =         16;              // 4-byte memory/register (register only)
MR8    =        17;              // 8-byte memory/MMX register in ModRM
RR8     =       18;              // 8-byte MMX register only in ModRM
MRD      =      19;              // 8-byte memory/3DNow! register in ModRM
RRD       =     20;              // 8-byte memory/3DNow! (register only)
MRJ        =    21;              // Memory/reg in ModRM as JUMP target
MMA         =   22;              // Memory address in ModRM byte for LEA
MML          =  23;              // Memory in ModRM byte (for LES)
MMS           = 24;              // Memory in ModRM byte (as SEG:OFFS)
MM6=            25;              // Memory in ModRm (6-byte descriptor)
MMB =           26;              // Two adjacent memory locations (BOUND)
MD2  =          27;              // Memory in ModRM (16-bit integer)
MB2   =         28;              // Memory in ModRM (16-bit binary)
MD4    =        29;              // Memory in ModRM byte (32-bit integer)
MD8     =       30;              // Memory in ModRM byte (64-bit integer)
MDA      =      31;              // Memory in ModRM byte (80-bit BCD)
MF4       =     32;              // Memory in ModRM byte (32-bit float)
MF8        =    33;              // Memory in ModRM byte (64-bit float)
MFA         =   34;              // Memory in ModRM byte (80-bit float)
MFE          =  35;              // Memory in ModRM byte (FPU environment)
MFS           = 36;              // Memory in ModRM byte (FPU state)
MFX=            37;              // Memory in ModRM byte (ext. FPU state)
MSO =           38;              // Source in string op's ([ESI])
MDE  =          39;              // Destination in string op's ([EDI])
MXL   =         40;              // XLAT operand ([EBX+AL])
IMM    =        41;              // Immediate data (8 or 16/32)
IMU     =       42;              // Immediate unsigned data (8 or 16/32)
VXD      =      43;              // VxD service
IMX       =     44;              // Immediate sign-extendable byte
C01        =    45;              // Implicit constant 1 (for shifts)
IMS         =   46;              // Immediate byte (for shifts)
IM1          =  47;              // Immediate byte
IM2           = 48;              // Immediate word (ENTER/RET)
IMA=            49;              // Immediate absolute near data address
JOB =           50;              // Immediate byte offset (for jumps)
JOW  =          51;              // Immediate full offset (for jumps)
JMF   =         52;              // Immediate absolute far jump/call addr
SGM    =        53;              // Segment register in ModRM byte
SCM     =       54;              // Segment register in command byte
CRX      =      55;              // Control register CRx
DRX       =     56;              // Debug register DRx
// Pseudooperands (implicit operands, never appear in assembler commands). Must
// have index equal to or exceeding PSEUDOOP.
PRN=           (PSEUDOOP+0);    // Near return address
PRF=            (PSEUDOOP+1);    // Far return address
PAC =           (PSEUDOOP+2);    // Accumulator (AL/AX/EAX)
PAH  =          (PSEUDOOP+3);    // AH (in LAHF/SAHF commands)
PFL   =         (PSEUDOOP+4);    // Lower byte of flags (in LAHF/SAHF)
PS0    =        (PSEUDOOP+5);    // Top of FPU stack (ST(0))
PS1     =       (PSEUDOOP+6);    // ST(1)
PCX      =      (PSEUDOOP+7);    // CX/ECX
PDI       =     (PSEUDOOP+8);    // EDI (in MMX extentions)

// Errors detected during command disassembling.
DAE_NOERR =     0;               // No error
DAE_BADCMD =    1;               // Unrecognized command
DAE_CROSS   =   2;               // Command crosses end of memory block
DAE_BADSEG   =  3;               // Undefined segment register
DAE_MEMORY    = 4;               // Register where only memory allowed
DAE_REGISTER   =5;               // Memory where only register allowed
DAE_INTERN     =6;               // Internal error


type t_addrdec =packed record
  defseg:integer;
  descr:pansichar;
end;

type t_cmddata = packed record
  mask:cardinal;                 // Mask for first 4 bytes of the command
  code:cardinal;                 // Compare masked bytes with this
  len:Byte;                  // Length of the main command code
  bits:byte;                 // Special bits within the command
  arg1,arg2,arg3:byte;       // Types of possible arguments
  _type:byte;                 // C_xxx + additional information
  name:pansichar;                // Symbolic name for this command
end;

// Initialized constant data structures used by all programs from assembler
// package. Contain names of register, register combinations or commands and
// their properties.


////////////////////////////////////////////////////////////////////////////////
//////////////////// ASSEMBLER, DISASSEMBLER AND EXPRESSIONS ///////////////////
const
MAXCMDSIZE  =   16;              // Maximal length of 80x86 command
MAXCALSIZE  =   8;               // Max length of CALL without prefixes
NMODELS    =    8;               // Number of assembler search models

INT3     =      $CC;            // Code of 1-byte breakpoint
NOP      =      $90;            // Code of 1-byte NOP command
TRAPFLAG =      $00000100;      // Trap flag in CPU flag register

REG_EAX   =     0;               // Indexes of general-purpose registers
REG_ECX  =      1;               // in t_reg.
REG_EDX  =      2;
REG_EBX  =      3;
REG_ESP  =      4;
REG_EBP  =      5;
REG_ESI   =     6;
REG_EDI  =      7;

SEG_UNDEF =    -1;
SEG_ES    =     0;               // Indexes of segment/selector registers
SEG_CS   =      1;
SEG_SS  =       2;
SEG_DS    =     3;
SEG_FS   =      4;
SEG_GS   =      5;

C_TYPEMASK     =$F0;            // Mask for command type
C_CMD        =$00;            // Ordinary instruction
C_PSH        =$10;            // 1-word PUSH instruction
C_POP        =$20;            // 1-word POP instruction
C_MMX        =$30;            // MMX instruction
C_FLT        =$40;            // FPU instruction
C_JMP        =$50;            // JUMP instruction
C_JMC      =$60 ;           // Conditional JUMP instruction
C_CAL       =$70 ;           // CALL instruction
C_RET        =$80;            // RET instruction
C_FLG        =$90;            // Changes system flags
C_RTF        =$A0;            // C_JMP and C_FLG simultaneously
C_REP        =$B0;            // Instruction with REPxx prefix
C_PRI        =$C0;            // Privileged instruction
C_DAT        =$D0;            // Data (address) doubleword
C_NOW        =$E0;            // 3DNow! instruction