disasm.pas

一款压缩壳PE123的DELPHI源码 学习写壳的很好的参考

C_BAD        =$F0;            // Unrecognized command
C_RARE         =$08;            // Rare command, seldom used in programs
C_SIZEMASK     =$07;            // MMX data size or special flag
C_EXPL       =$01;            // (non-MMX) Specify explicit memory size

C_DANGER95     =$01;            // Command is dangerous under Win95/98
C_DANGER       =$03;            // Command is dangerous everywhere
C_DANGERLOCK   =$07;            // Dangerous with LOCK prefix

DEC_TYPEMASK   =$1F;            // Type of memory byte
DEC_UNKNOWN  =$00;            // Unknown type
DEC_BYTE     =$01;            // Accessed as byte
DEC_WORD     =$02;            // Accessed as short
DEC_NEXTDATA =$03;            // Subsequent byte of code or data
DEC_DWORD    =$04;            // Accessed as long
DEC_FLOAT4   =$05;            // Accessed as float
DEC_FWORD    =$06;            // Accessed as descriptor/long pointer
DEC_FLOAT8   =$07;            // Accessed as double
DEC_QWORD    =$08 ;           // Accessed as 8-byte integer
DEC_FLOAT10  =$09;            // Accessed as long double
DEC_TBYTE    =$0A;            // Accessed as 10-byte integer
DEC_STRING   =$0B;            // Zero-terminated ASCII string
DEC_UNICODE  =$0C;            // Zero-terminated UNICODE string
DEC_3DNOW    =$0D ;           // Accessed as 3Dnow operand
DEC_BYTESW   =$11;            // Accessed as byte index to switch
DEC_NEXTCODE =$13;            // Subsequent byte of command
DEC_COMMAND  =$1D;            // First byte of command
DEC_JMPDEST  =$1E;            // Jump destination
DEC_CALLDEST =$1F;            // Call (and maybe jump) destination
DEC_PROCMASK   =$60;            // Procedure analysis
DEC_PROC     =$20 ;           // Start of procedure
DEC_PBODY    =$40 ;           // Body of procedure
DEC_PEND     =$60 ;           // End of procedure
DEC_CHECKED    =$80;            // Byte was analysed

DECR_TYPEMASK  =$3F ;           // Type of register or memory
DECR_BYTE    =$21 ;           // Byte register
DECR_WORD    =$22 ;           // Short integer register
DECR_DWORD   =$24;            // Long integer register
DECR_QWORD   =$28;            // MMX register
DECR_FLOAT10 =$29;            // Floating-point register
DECR_SEG     =$2A;            // Segment register
DECR_3DNOW   =$2D ;           // 3Dnow! register
DECR_ISREG     =$20;            // Mask to check that operand is register

DISASM_SIZE  =  0;               // Determine command size only
DISASM_DATA  =  1;               // Determine size and analysis data
DISASM_FILE  =  3;               // Disassembly, no symbols
DISASM_CODE   = 4;               // Full disassembly

// Warnings issued by Disasm():
DAW_FARADDR    =$0001;          // Command is a far jump, call or return
DAW_SEGMENT    =$0002 ;         // Command loads segment register
DAW_PRIV       =$0004;          // Privileged command
DAW_IO         =$0008;          // I/O command
DAW_SHIFT      =$0010 ;         // Shift constant out of range 1..31
DAW_PREFIX     =$0020;          // Superfluous prefix
DAW_LOCK       =$0040;          // Command has LOCK prefix
DAW_STACK      =$0080 ;         // Unaligned stack operation
DAW_DANGER95   =$1000;          // May mess up Win95 if executed
DAW_DANGEROUS  =$3000;          // May mess up any OS if executed


type t_asmmodel=packed record           // Model to search for assembler command
  code:array[0..MAXCMDSIZE] of byte;   // Binary code
  mask:array[0..MAXCMDSIZE] of byte;   // Mask for binary code (0: bit ignored)
  length:integer;               // Length of code, bytes (0: empty)
  jmpsize:integer;              // Offset size if relative jump
  jmpoffset:integer;            // Offset relative to IP
  jmppos:integer;               // Position of jump offset in command
end;

Const disasmDLL = 'disasm.dll';
{pointer to t_asmmodel struck}

type t_disasm = packed record               // Results of disassembling
  pi:cardinal;                   // Instrucion pointer
  dump:array[0..TEXTLEN] of BYTE;        // Hexadecimal dump of the command
  result:array[0..TEXTLEN] of BYTE;      // Disassembled command
  comment:array[0..TEXTLEN] of BYTE;     // Brief comment
  cmdtype:integer;              // One of C_xxx
  memtype:integer;              // Type of addressed variable in memory
  nprefix:integer;              // Number of prefixes
  indexed:integer;              // Address contains register(s)
  jmpconst:cardinal;             // Constant jump address
  jmptable:cardinal;             // Possible address of switch table
  adrconst:cardinal;             // Constant part of address
  immconst:cardinal;             // Immediate constant
  zeroconst:integer;            // Whether contains zero constant
  fixupoffset:integer;          // Possible offset of 32-bit fixups
  fixupsize:integer;            // Possible total size of fixups or 0
  error:integer;                // Error while disassembling command
  warnings:integer;             // Combination of DAW_xxx
end;

function Assemble(cmd:pansichar;ip:cardinal;model:pointer;attempt:integer;constsize:integer;errtext:pansichar):integer;stdcall;
function DisAssemble(src:pansichar;srcsize:cardinal;srcip:cardinal;disasm:pointer;disasmmode:integer):Cardinal;stdcall;
function Checkcondition(code:integer;flags:cardinal):integer;stdcall;
function Decodeaddress(addr:cardinal;symb:pansichar;nsymb:integer;comment:pansichar):integer ;stdcall;
function Disassembleback(block:pansichar;base:cardinal;size:cardinal;ip:cardinal;n:integer):cardinal ;stdcall;
function Disassembleforward(block:pansichar;base:cardinal;size:cardinal;ip:cardinal;n:integer):cardinal ;stdcall;
function Isfilling(addr:cardinal;data:pansichar;size:cardinal;align:cardinal):integer ;stdcall;
function Print3dnow(s:pansichar;f:pansichar) :integer;stdcall;
function Printfloat10(s:pansichar;ext:int64):integer ;stdcall;
function Printfloat4(s:pansichar;f:int64):integer ;stdcall;
function Printfloat8(s:pansichar;d:Double):integer;stdcall;

procedure setideal(value:integer);stdcall;
procedure setlowercase(value:integer);stdcall;
procedure settabarguments(value:integer);stdcall;
procedure setextraspace(value:integer);stdcall;
procedure setputdefseg(value:integer);stdcall;
procedure setshowmemsize(value:integer);stdcall;
procedure setshownear(value:integer);stdcall;
procedure setshortstringcmds(value:integer);stdcall;
procedure setsizesens(value:integer);stdcall;
procedure setsymbolic(value:integer);stdcall;
procedure setfarcalls(value:integer);stdcall;
procedure setdecodevxd(value:integer);stdcall;
procedure setprivileged(value:integer);stdcall;
procedure setiocommand(value:integer);stdcall;
procedure setbadshift(value:integer);stdcall;
procedure setextraprefix(value:integer);stdcall;
procedure setlockedbus(value:integer);stdcall;
procedure setstackalign(value:integer);stdcall;
procedure setiswindowsnt(value:integer);stdcall;

implementation

function Assemble; external disasmDLL name 'Function0';
function DisAssemble; external disasmDLL name 'Function1';
function Checkcondition; external disasmDLL name 'Function2';
function Decodeaddress ; external disasmDLL name 'Function3';
function Disassembleback ; external disasmDLL name 'Function4';
function Disassembleforward ; external disasmDLL name 'Function5';
function Isfilling ; external disasmDLL name 'Function6';
function Print3dnow ; external disasmDLL name 'Function7';
function Printfloat10 ; external disasmDLL name 'Function8';
function Printfloat4 ; external disasmDLL name 'Function9';
function Printfloat8 ; external disasmDLL name 'Function10';

procedure setideal; external disasmDLL name 'Function11';
procedure setlowercase; external disasmDLL name 'Function12';
procedure settabarguments; external disasmDLL name 'Function13';
procedure setextraspace; external disasmDLL name 'Function14';
procedure setputdefseg; external disasmDLL name 'Function15';
procedure setshowmemsize; external disasmDLL name 'Function16';
procedure setshownear; external disasmDLL name 'Function17';
procedure setshortstringcmds; external disasmDLL name 'Function18';
procedure setsizesens; external disasmDLL name 'Function19';
procedure setsymbolic; external disasmDLL name 'Function20';
procedure setfarcalls; external disasmDLL name 'Function21';
procedure setdecodevxd; external disasmDLL name 'Function22';
procedure setprivileged; external disasmDLL name 'Function23';
procedure setiocommand; external disasmDLL name 'Function24';
procedure setbadshift; external disasmDLL name 'Function25';
procedure setextraprefix; external disasmDLL name 'Function26';
procedure setlockedbus; external disasmDLL name 'Function27';
procedure setstackalign; external disasmDLL name 'Function28';
procedure setiswindowsnt; external disasmDLL name 'Function29';

end.