📄 disasm.c
字号:
if (c >= 064 && c <= 066) {
ins->oprs[c - 064].offset = *data++;
ins->oprs[c - 064].offset |= (((unsigned)*data++) << 8);
if (osize == 32) {
ins->oprs[c - 064].offset |= (((long)*data++) << 16);
ins->oprs[c - 064].offset |= (((long)*data++) << 24);
ins->oprs[c - 064].segment |= SEG_32BIT;
} else
ins->oprs[c - 064].segment &= ~SEG_32BIT;
ins->oprs[c - 064].segment |= SEG_RELATIVE;
if (segsize != osize) {
ins->oprs[c - 064].type =
(ins->oprs[c - 064].type & NON_SIZE)
| ((osize == 16) ? BITS16 : BITS32);
}
}
if (c >= 070 && c <= 072) {
ins->oprs[c - 070].offset = *data++;
ins->oprs[c - 070].offset |= (((unsigned)*data++) << 8);
ins->oprs[c - 070].offset |= (((long)*data++) << 16);
ins->oprs[c - 070].offset |= (((long)*data++) << 24);
ins->oprs[c - 070].segment |= SEG_32BIT | SEG_RELATIVE;
}
if (c >= 0100 && c < 0130) {
int modrm = *data++;
ins->oprs[c & 07].basereg = (modrm >> 3) & 07;
ins->oprs[c & 07].segment |= SEG_RMREG;
data = do_ea(data, modrm, asize, segsize,
&ins->oprs[(c >> 3) & 07]);
}
if (c >= 0130 && c <= 0132) {
ins->oprs[c - 0130].offset = *data++;
ins->oprs[c - 0130].offset |= (((unsigned)*data++) << 8);
}
if (c >= 0140 && c <= 0142) {
ins->oprs[c - 0140].offset = *data++;
ins->oprs[c - 0140].offset |= (((unsigned)*data++) << 8);
ins->oprs[c - 0140].offset |= (((long)*data++) << 16);
ins->oprs[c - 0140].offset |= (((long)*data++) << 24);
}
if (c >= 0200 && c <= 0277) {
int modrm = *data++;
if (((modrm >> 3) & 07) != (c & 07))
return FALSE; /* spare field doesn't match up */
data = do_ea(data, modrm, asize, segsize,
&ins->oprs[(c >> 3) & 07]);
}
if (c >= 0300 && c <= 0302) {
if (asize)
ins->oprs[c - 0300].segment |= SEG_32BIT;
else
ins->oprs[c - 0300].segment &= ~SEG_32BIT;
a_used = TRUE;
}
if (c == 0310) {
if (asize == 32)
return FALSE;
else
a_used = TRUE;
}
if (c == 0311) {
if (asize == 16)
return FALSE;
else
a_used = TRUE;
}
if (c == 0312) {
if (asize != segsize)
return FALSE;
else
a_used = TRUE;
}
if (c == 0320) {
if (osize == 32)
return FALSE;
else
o_used = TRUE;
}
if (c == 0321) {
if (osize == 16)
return FALSE;
else
o_used = TRUE;
}
if (c == 0322) {
if (osize != segsize)
return FALSE;
else
o_used = TRUE;
}
if (c == 0330) {
int t = *r++, d = *data++;
if (d < t || d > t + 15)
return FALSE;
else
ins->condition = d - t;
}
if (c == 0331) {
if (rep)
return FALSE;
}
if (c == 0332) {
if (drep == P_REP)
drep = P_REPE;
}
if (c == 0333) {
if (rep != 0xF3)
return FALSE;
drep = 0;
}
}
/*
* Check for unused rep or a/o prefixes.
*/
ins->nprefix = 0;
if (drep)
ins->prefixes[ins->nprefix++] = drep;
if (!a_used && asize != segsize)
ins->prefixes[ins->nprefix++] = (asize == 16 ? P_A16 : P_A32);
if (!o_used && osize != segsize)
ins->prefixes[ins->nprefix++] = (osize == 16 ? P_O16 : P_O32);
return data - origdata;
}
long disasm(unsigned char *data, char *output, int outbufsize, int segsize,
long offset, int autosync, unsigned long prefer)
{
struct itemplate **p, **best_p;
int length, best_length = 0;
char *segover;
int rep, lock, asize, osize, i, slen, colon;
unsigned char *origdata;
int works;
insn tmp_ins, ins;
unsigned long goodness, best;
/*
* Scan for prefixes.
*/
asize = osize = segsize;
segover = NULL;
rep = lock = 0;
origdata = data;
for (;;) {
if (*data == 0xF3 || *data == 0xF2)
rep = *data++;
else if (*data == 0xF0)
lock = *data++;
else if (*data == 0x2E || *data == 0x36 || *data == 0x3E ||
*data == 0x26 || *data == 0x64 || *data == 0x65) {
switch (*data++) {
case 0x2E:
segover = "cs";
break;
case 0x36:
segover = "ss";
break;
case 0x3E:
segover = "ds";
break;
case 0x26:
segover = "es";
break;
case 0x64:
segover = "fs";
break;
case 0x65:
segover = "gs";
break;
}
} else if (*data == 0x66)
osize = 48 - segsize, data++;
else if (*data == 0x67)
asize = 48 - segsize, data++;
else
break;
}
tmp_ins.oprs[0].segment = tmp_ins.oprs[1].segment =
tmp_ins.oprs[2].segment =
tmp_ins.oprs[0].addr_size = tmp_ins.oprs[1].addr_size =
tmp_ins.oprs[2].addr_size = (segsize == 16 ? 0 : SEG_32BIT);
tmp_ins.condition = -1;
best = ~0UL; /* Worst possible */
best_p = NULL;
for (p = itable[*data]; *p; p++) {
if ((length = matches(*p, data, asize, osize,
segsize, rep, &tmp_ins))) {
works = TRUE;
/*
* Final check to make sure the types of r/m match up.
*/
for (i = 0; i < (*p)->operands; i++) {
if (
/* If it's a mem-only EA but we have a register, die. */
((tmp_ins.oprs[i].segment & SEG_RMREG) &&
!(MEMORY & ~(*p)->opd[i])) ||
/* If it's a reg-only EA but we have a memory ref, die. */
(!(tmp_ins.oprs[i].segment & SEG_RMREG) &&
!(REGNORM & ~(*p)->opd[i]) &&
!((*p)->opd[i] & REG_SMASK)) ||
/* Register type mismatch (eg FS vs REG_DESS): die. */
((((*p)->opd[i] & (REGISTER | FPUREG)) ||
(tmp_ins.oprs[i].segment & SEG_RMREG)) &&
!whichreg((*p)->opd[i],
tmp_ins.oprs[i].basereg))) {
works = FALSE;
break;
}
}
if (works) {
goodness = ((*p)->flags & IF_PFMASK) ^ prefer;
if (goodness < best) {
/* This is the best one found so far */
best = goodness;
best_p = p;
best_length = length;
ins = tmp_ins;
}
}
}
}
if (!best_p)
return 0; /* no instruction was matched */
/* Pick the best match */
p = best_p;
length = best_length;
slen = 0;
/* TODO: snprintf returns the value that the string would have if
* the buffer were long enough, and not the actual length of
* the returned string, so each instance of using the return
* value of snprintf should actually be checked to assure that
* the return value is "sane." Maybe a macro wrapper could
* be used for that purpose.
*/
if (lock)
slen += snprintf(output + slen, outbufsize - slen, "lock ");
for (i = 0; i < ins.nprefix; i++)
switch (ins.prefixes[i]) {
case P_REP:
slen += snprintf(output + slen, outbufsize - slen, "rep ");
break;
case P_REPE:
slen += snprintf(output + slen, outbufsize - slen, "repe ");
break;
case P_REPNE:
slen += snprintf(output + slen, outbufsize - slen, "repne ");
break;
case P_A16:
slen += snprintf(output + slen, outbufsize - slen, "a16 ");
break;
case P_A32:
slen += snprintf(output + slen, outbufsize - slen, "a32 ");
break;
case P_O16:
slen += snprintf(output + slen, outbufsize - slen, "o16 ");
break;
case P_O32:
slen += snprintf(output + slen, outbufsize - slen, "o32 ");
break;
}
for (i = 0; i < elements(ico); i++)
if ((*p)->opcode == ico[i]) {
slen +=
snprintf(output + slen, outbufsize - slen, "%s%s", icn[i],
whichcond(ins.condition));
break;
}
if (i >= elements(ico))
slen +=
snprintf(output + slen, outbufsize - slen, "%s",
insn_names[(*p)->opcode]);
colon = FALSE;
length += data - origdata; /* fix up for prefixes */
for (i = 0; i < (*p)->operands; i++) {
output[slen++] = (colon ? ':' : i == 0 ? ' ' : ',');
if (ins.oprs[i].segment & SEG_RELATIVE) {
ins.oprs[i].offset += offset + length;
/*
* sort out wraparound
*/
if (!(ins.oprs[i].segment & SEG_32BIT))
ins.oprs[i].offset &= 0xFFFF;
/*
* add sync marker, if autosync is on
*/
if (autosync)
add_sync(ins.oprs[i].offset, 0L);
}
if ((*p)->opd[i] & COLON)
colon = TRUE;
else
colon = FALSE;
if (((*p)->opd[i] & (REGISTER | FPUREG)) ||
(ins.oprs[i].segment & SEG_RMREG)) {
ins.oprs[i].basereg = whichreg((*p)->opd[i],
ins.oprs[i].basereg);
if ((*p)->opd[i] & TO)
slen += snprintf(output + slen, outbufsize - slen, "to ");
slen += snprintf(output + slen, outbufsize - slen, "%s",
reg_names[ins.oprs[i].basereg -
EXPR_REG_START]);
} else if (!(UNITY & ~(*p)->opd[i])) {
output[slen++] = '1';
} else if ((*p)->opd[i] & IMMEDIATE) {
if ((*p)->opd[i] & BITS8) {
slen +=
snprintf(output + slen, outbufsize - slen, "byte ");
if (ins.oprs[i].segment & SEG_SIGNED) {
if (ins.oprs[i].offset < 0) {
ins.oprs[i].offset *= -1;
output[slen++] = '-';
} else
output[slen++] = '+';
}
} else if ((*p)->opd[i] & BITS16) {
slen +=
snprintf(output + slen, outbufsize - slen, "word ");
} else if ((*p)->opd[i] & BITS32) {
slen +=
snprintf(output + slen, outbufsize - slen, "dword ");
} else if ((*p)->opd[i] & NEAR) {
slen +=
snprintf(output + slen, outbufsize - slen, "near ");
} else if ((*p)->opd[i] & SHORT) {
slen +=
snprintf(output + slen, outbufsize - slen, "short ");
}
slen +=
snprintf(output + slen, outbufsize - slen, "0x%lx",
ins.oprs[i].offset);
} else if (!(MEM_OFFS & ~(*p)->opd[i])) {
slen +=
snprintf(output + slen, outbufsize - slen, "[%s%s%s0x%lx]",
(segover ? segover : ""), (segover ? ":" : ""),
(ins.oprs[i].addr_size ==
32 ? "dword " : ins.oprs[i].addr_size ==
16 ? "word " : ""), ins.oprs[i].offset);
segover = NULL;
} else if (!(REGMEM & ~(*p)->opd[i])) {
int started = FALSE;
if ((*p)->opd[i] & BITS8)
slen +=
snprintf(output + slen, outbufsize - slen, "byte ");
if ((*p)->opd[i] & BITS16)
slen +=
snprintf(output + slen, outbufsize - slen, "word ");
if ((*p)->opd[i] & BITS32)
slen +=
snprintf(output + slen, outbufsize - slen, "dword ");
if ((*p)->opd[i] & BITS64)
slen +=
snprintf(output + slen, outbufsize - slen, "qword ");
if ((*p)->opd[i] & BITS80)
slen +=
snprintf(output + slen, outbufsize - slen, "tword ");
if ((*p)->opd[i] & FAR)
slen += snprintf(output + slen, outbufsize - slen, "far ");
if ((*p)->opd[i] & NEAR)
slen +=
snprintf(output + slen, outbufsize - slen, "near ");
output[slen++] = '[';
if (ins.oprs[i].addr_size)
slen += snprintf(output + slen, outbufsize - slen, "%s",
(ins.oprs[i].addr_size == 32 ? "dword " :
ins.oprs[i].addr_size ==
16 ? "word " : ""));
if (segover) {
slen +=
snprintf(output + slen, outbufsize - slen, "%s:",
segover);
segover = NULL;
}
if (ins.oprs[i].basereg != -1) {
slen += snprintf(output + slen, outbufsize - slen, "%s",
reg_names[(ins.oprs[i].basereg -
EXPR_REG_START)]);
started = TRUE;
}
if (ins.oprs[i].indexreg != -1) {
if (started)
output[slen++] = '+';
slen += snprintf(output + slen, outbufsize - slen, "%s",
reg_names[(ins.oprs[i].indexreg -
EXPR_REG_START)]);
if (ins.oprs[i].scale > 1)
slen +=
snprintf(output + slen, outbufsize - slen, "*%d",
ins.oprs[i].scale);
started = TRUE;
}
if (ins.oprs[i].segment & SEG_DISP8) {
int sign = '+';
if (ins.oprs[i].offset & 0x80) {
ins.oprs[i].offset = -(signed char)ins.oprs[i].offset;
sign = '-';
}
slen +=
snprintf(output + slen, outbufsize - slen, "%c0x%lx",
sign, ins.oprs[i].offset);
} else if (ins.oprs[i].segment & SEG_DISP16) {
if (started)
output[slen++] = '+';
slen +=
snprintf(output + slen, outbufsize - slen, "0x%lx",
ins.oprs[i].offset);
} else if (ins.oprs[i].segment & SEG_DISP32) {
if (started)
output[slen++] = '+';
slen +=
snprintf(output + slen, outbufsize - slen, "0x%lx",
ins.oprs[i].offset);
}
output[slen++] = ']';
} else {
slen +=
snprintf(output + slen, outbufsize - slen, "<operand%d>",
i);
}
}
output[slen] = '\0';
if (segover) { /* unused segment override */
char *p = output;
int count = slen + 1;
while (count--)
p[count + 3] = p[count];
strncpy(output, segover, 2);
output[2] = ' ';
}
return length;
}
long eatbyte(unsigned char *data, char *output, int outbufsize)
{
snprintf(output, outbufsize, "db 0x%02X", *data);
return 1;
}
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -