x86il.h

可以将机器码计算为汇编指令并且算出指令长度的C头文件。在编写Ring0或Ring3的Inline Hook时不可缺少的东西。

//22 - MOV CRX, R32
//23 - MOV DRX, R32
  {1, 0, 1, 0},

//24 - MOV R32, TRX
//25 - ???
  {1, 0, 1, 0},

//26 - MOV TRX, R32
//27 - ???
  {1, 0, 1, 0},

//28 - MOVAPS XMM, X/M32
//29 - MOVAPS X/M32, XMM
  {0, 1, 0, 1},

//2A - CVTPI2PS XMM, X/M32
//2B - MOVNTPS X/M32, XMM
  {0, 1, 0, 1},

//2C - CVTTPS2PI XMM, X/M32
//2D - CVTPS2PI XMM, X/M32
  {0, 1, 0, 1},

//2E - UCOMISS XMM, X/M32
//2F - COMISS XMM, X/M32
  {0, 1, 0, 1},

//30 - WRMSR
//31 - RDTSC
  {0, 0, 0, 0},

//32 - RDMSR
//33 - RDPMC
  {0, 0, 0, 0},

//34 - SYSENTER
//35 - SYSEXIT
  {0, 0, 0, 0},

//36 - ???
//37 - ???
  {0, 0, 0, 0},

//38 - ???
//39 - ???
  {0, 0, 0, 0},

//3A - ???
//3B - ???
  {0, 0, 0, 0},

//3C - ???
//3D - ???
  {0, 0, 0, 0},

//3E - ???
//3F - ???
  {0, 0, 0, 0},

//40 - CMOVO      R32, R/M32
//41 - CMOVNO     R32, R/M32
  {0, 1, 0, 1},

//42 - CMOVC/CMOVB/CMOVNAE R32, R/M32
//43 - CMOVNC/CMOVNB/CMOVAE R32, R/M32
  {0, 1, 0, 1},

//44 - CMOVE/CMOVZ R32, R/M32
//45 - CMOVNE/CMOVNZ R32, R/M32
  {0, 1, 0, 1},

//46 - CMOVBE/CMOVNA R32, R/M32
//47 - CMOVA/CMOVNBE R32, R/M32
  {0, 1, 0, 1},

//48 - CMOVS      R32, R/M32
//49 - CMOVS     R32, R/M32
  {0, 1, 0, 1},

//4A - CMOVP/CMOVPE  R32, R/M32
//4B - CMOVNP/CMOVPO R32, R/M32
  {0, 1, 0, 1},

//4C - CMOVL/CMOVNGE R32, R/M32
//4D - CMOVGE/CMOVNL R32, R/M32
  {0, 1, 0, 1},

//4E - CMOVNG/CMOVLE R32, R/M32
//4F - CMOVG/CMOVNLE R32, R/M32
  {0, 1, 0, 1},

//50 - ???
//51 - SQRTPS XMM, X/M32
  {0, 0, 0, 1},

//52 - RSQRTPS XMM, X/M32
//53 - RCPPS XMM, X/M32
  {0, 1, 0, 1},

//54 - ANDPS XMM, X/M32
//55 - ANDNPS XMM, X/M32
  {0, 1, 0, 1},

//56 - ORPS XMM, X/M32
//57 - XORPS XMM, X/M32
  {0, 1, 0, 1},

//58 - ADDPS XMM, X/M32
//59 - MULPS XMM, X/M32
  {0, 1, 0, 1},

//5A - CVTPS2PD XMM, X/M32
//5B - CVTDQ2PS XMM, X/M32
  {0, 1, 0, 1},

//5C - SUBPS XMM, X/M32
//5D - MINPS XMM, X/M32
  {0, 1, 0, 1},

//5E - DIVPS XMM, X/M32
//5F - MAXPS XMM, X/M32
  {0, 1, 0, 1},

//60 - PUNPCKLBW XMM, X/M32
//61 - PUNPCKLWD XMM, X/M32
  {0, 1, 0, 1},

//62 - PUNPCKLDQ XMM, X/M32
//63 - PACKSSWB XMM, X/M32
  {0, 1, 0, 1},

//64 - PCMPGTB XMM, X/M32
//65 - PCMPGTW XMM, X/M32
  {0, 1, 0, 1},

//66 - PCMPGTD XMM, X/M32
//67 - PACKUSWB XMM, X/M32
  {0, 1, 0, 1},

//68 - PUNPCKHBW XMM, X/M32
//69 - PUNPCKHWD XMM, X/M32
  {0, 1, 0, 1},

//6A - PUNPCKHDQ XMM, X/M32
//6B - PACKSSDW XMM, X/M32
  {0, 1, 0, 1},

//6C - ???
//6D - ???
  {0, 0, 0, 0},

//6E - MOVD XMM, X/M32
//6F - MOVQ XMM, X/M32
  {0, 1, 0, 1},

//70 - PSHUFW XMM, X/M32, IMM8
//71 - ???/???/PSRLW/???/PSRAW/???/PSLLW/??? XMM, IMM8
  {1, 1, 1, 1},

//72 - ???/???/PSRLD/???/PSRAD/???/PSLLD/??? XMM, IMM8
//73 - ???/???/PSRLQ/PSRLDQ/???/???/PSLLQ/PSLLDQ XMM, IMM8
  {1, 1, 1, 1},

//74 - PCMPEQB XMM, X/M32
//75 - PCMPEQW XMM, X/M32
  {0, 1, 0, 1},

//76 - PCMPEQW XMM, X/M32
//77 - EMMS
  {0, 1, 0, 0},

//78 - ???
//79 - ???
  {0, 0, 0, 0},

//7A - ???
//7B - ???
  {0, 0, 0, 0},

//7C - ???
//7D - ???
  {0, 0, 0, 0},

//7E - MOVD X/M32, XMM
//7F - MOVQ X/M32, XMM
  {0, 1, 0, 1},

//80 - JO      REL32
//81 - JNO     REL32
  {X86IL_OS_32, 0, X86IL_OS_32, 0},

//82 - JC/JB/JNAE REL32
//83 - JNC/JNB/JAE REL32
  {X86IL_OS_32, 0, X86IL_OS_32, 0},

//84 - JE/JZ   REL32
//85 - JNE/JNZ REL32
  {X86IL_OS_32, 0, X86IL_OS_32, 0},

//86 - JBE/JNA REL32
//87 - JA/JNBE REL32
  {X86IL_OS_32, 0, X86IL_OS_32, 0},

//88 - JS      REL32
//89 - JNS     REL32
  {X86IL_OS_32, 0, X86IL_OS_32, 0},

//8A - JP/JPE  REL32
//8B - JNP/JPO REL32
  {X86IL_OS_32, 0, X86IL_OS_32, 0},

//8C - JL/JNGE REL32
//8D - JGE/JNL REL32
  {X86IL_OS_32, 0, X86IL_OS_32, 0},

//8E - JNG/JLE REL32
//8F - JG/JNLE REL32
  {X86IL_OS_32, 0, X86IL_OS_32, 0},

//90 - SETO      R/M8
//91 - SETNO     R/M8
  {0, 1, 0, 1},

//92 - SETC/SETB/SETNAE R/M8
//93 - SETNC/SETNB/SETAE R/M8
  {0, 1, 0, 1},

//94 - SETE/SETZ R/M8
//95 - SETNE/SETNZ R/M8
  {0, 1, 0, 1},

//96 - SETBE/SETNA R/M8
//97 - SETA/SETNBE R/M8
  {0, 1, 0, 1},

//98 - SETS      R/M8
//99 - SETNS     R/M8
  {0, 1, 0, 1},

//9A - SETP/SETPE  R/M8
//9B - SETNP/SETPO R/M8
  {0, 1, 0, 1},

//9C - SETL/SETNGE R/M8
//9D - SETGE/SETNL R/M8
  {0, 1, 0, 1},

//9E - SETNG/SETLE R/M8
//9F - SETG/SETNLE R/M8
  {0, 1, 0, 1},

//A0 - PUSH FS
//A1 - POP FS
  {0, 0, 0, 0},

//A2 - CPUID
//A3 - BT R/M32, R32
  {0, 0, 0, 1},

//A4 - SHLD R/M32, R32, IMM8
//A5 - SHLD R/M32, R32, CL
  {1, 1, 0, 1},

//A6 - ???
//A7 - ???
  {0, 0, 0, 0},

//A8 - PUSH GS
//A9 - POP GS
  {0, 0, 0, 0},

//AA - RSM
//AB - BTS R/M32, R32
  {0, 0, 0, 1},

//AC - SHRD R/M32, R32, IMM8
//AD - SHRD R/M32, R32, CL
  {1, 1, 0, 1},

//AE /X - FXSAVE/FXRSTOR/LDMXCSR/STMXCSR/???/???/???/CLFLUSH  R/M32 //LFENCE/MFENCE
//AF - IMUL R32, R/M32
  {0, 1, 0, 1},

//B0 - CMPXCHG R/M8, R8
//B1 - CMPXCHG R/M32, R32
  {0, 1, 0, 1},

//B2 - LSS R32, R/M32
//B3 - BTR R/M32, R32
  {0, 1, 0, 1},

//B4 - LFS R32, R/M32
//B5 - LGS R32, R/M32
  {0, 1, 0, 1},

//B6 - MOVZX R32, R/M8
//B7 - MOVZX R32, R/M16
  {0, 1, 0, 1},

//B8 - ???
//B9 - ???
  {0, 0, 0, 0},

//BA /X - ???/???/???/???/BT/BTS/BTR/BTC R/M32, IMM8
//BB - BTC R/M32, R32
  {1, 1, 0, 1},

//BC - BSF   R32, R/M32
//BD - BSR   R32, R/M32
  {0, 1, 0, 1},

//BE - MOVSX R32, R/M8
//BF - MOVSX R32, R/M16
  {0, 1, 0, 1},

//C0 - XADD R/M8, R8
//C1 - XADD R/M32, R32
  {0, 1, 0, 1},

//C2 - CMPEQPS R/M32, R32
//C3 - MOVNTI R/M32, R32
  {0, 1, 0, 1},

//C4 - PINSRW R/M32, R32, IMM8
//C5 - PEXTRW R/M32, R32, IMM8
  {1, 1, 1, 1},

//C6 - SHUFPS R/M32, R32, IMM8
//C7 - CMPXCHG8B R/M64
  {1, 1, 0, 1},

//C8 - BSWAP   EAX
//C9 - BSWAP   ECX
  {0, 0, 0, 0},

//CA - BSWAP   EDX
//CB - BSWAP   EBX
  {0, 0, 0, 0},

//CC - BSWAP   ESP
//CD - BSWAP   EBP
  {0, 0, 0, 0},

//CE - BSWAP   ESI
//CF - BSWAP   EDI
  {0, 0, 0, 0},

//D0 - ???
//D1 - PSRLW R/M32
  {0, 0, 0, 1},

//D2 - PSRLD R/M32
//D3 - PSRLQ R/M32
  {0, 1, 0, 1},

//D4 - PADDQ R/M32
//D5 - PMULLW R/M32
  {0, 1, 0, 1},

//D6 - ???
//D7 - PMOVMSKB R/M32
  {0, 0, 0, 1},

//D8 - PSUBUSB R/M32
//D9 - PSUBUSW R/M32
  {0, 1, 0, 1},

//DA - PMINUB R/M32
//DB - PAND R/M32
  {0, 1, 0, 1},

//DC - PADDUSB R/M32
//DD - PADDUSW R/M32
  {0, 1, 0, 1},

//DE - PMAXUB R/M32
//DF - PANDN R/M32
  {0, 1, 0, 1},

//E0 - PAVGB R/M32
//E1 - PSRAW R/M32
  {0, 1, 0, 1},

//E2 - PSRAD R/M32
//E3 - PAVGW R/M32
  {0, 1, 0, 1},

//E4 - PMULHUW R/M32
//E5 - PMULHW R/M32
  {0, 1, 0, 1},

//E6 - ???
//E7 - MOVNTQ,MOVNTDQ R/M32
  {0, 0, 0, 1},

//E8 - PSUBSB R/M32
//E9 - PSUBSW R/M32
  {0, 1, 0, 1},

//EA - PMINSW R/M32
//EB - POR R/M32
  {0, 1, 0, 1},

//EC - PADDSB R/M32
//ED - PADDSW R/M32
  {0, 1, 0, 1},

//EE - PMAXSW R/M32
//EF - PXOR R/M32
  {0, 1, 0, 1},

//F0 - ???
//F1 - PSLLW R/M32
  {0, 0, 0, 1},

//F2 - PSLLD R/M32
//F3 - PSLLQ R/M32
  {0, 1, 0, 1},

//F4 - PMULUDQ R/M32
//F5 - PMADDWD R/M32
  {0, 1, 0, 1},

//F6 - PSADBW R/M32
//F7 - PMASKMOVQ R/M32
  {0, 1, 0, 1},

//F8 - PSUBB R/M32
//F9 - PSUBW R/M32
  {0, 1, 0, 1},

//FA - PSUBD R/M32
//FB - PSUBQ R/M32
  {0, 1, 0, 1},

//FC - PADDB R/M32
//FD - PADDW R/M32
  {0, 1, 0, 1},

//FE - PADDD R/M32
//FF - ???
  {0, 1, 0, 0}
};

//===================================================================

#define X86IL_PREFIX_COUNT 11
const unsigned char X86IL_Prefixes[X86IL_PREFIX_COUNT] = {
  0x26, 0x2E, 0x36, 0x3E,
  0x64, 0x65, 0x66, 0x67,
  0xF0, 0xF2, 0xF3
};

//===================================================================
int
  X86IL(int Bits,
        const unsigned char *pOriI,
        unsigned char *pAnaI,
        int *pnPfx,
        int *pModRM,
        int *pISize
 ) {

  int DefOpdSize;  // 4 unsigned char for 32bit,  2 unsigned char for 16bit
  int FixOpdSize;  // 0 unsigned char for 32bit, -2 unsigned char for 16bit because tables are 32bit
  int AddressMode; // 0 - 32bit, 1 - 16bit table
  int X86Idx;
  unsigned char OpCode;
  unsigned char ModRM;
  int ModRMAnd7;
  int IsSIB;
  #define i ModRM

  union {
    unsigned char b;
    X86IL_INSTRUCTION_PAIR_DESCRIPTION InstrDesc;
  } u;

//Init------------------------------------------------------------------------

  int OSChanged   = 0;
  int AMChanged   = 0;
  int ILength     = 0;  
  int OpdSize     = 0;
  int ModRMLength = 0;
  char Rex = 0;

  *pModRM = 0;

  if(Bits > 0) {
    DefOpdSize  = +X86IL_OS_16;
    FixOpdSize  = -2;
    AddressMode = +1;
  }
  else {
    DefOpdSize  = +X86IL_OS_32;
    FixOpdSize  = +0;
    AddressMode = +0;
  }

//Prefix----------------------------------------------------------------------

  while(ILength < 16) {
    pAnaI[ILength] = OpCode = pOriI[ILength];
    ILength++;

    if(Bits < 0) {
      if((OpCode >= 0x40) && (OpCode <= 0x4F)) {
        Rex = OpCode;
        continue;
      }
    }

    for(i = 0; (i < X86IL_PREFIX_COUNT) && (X86IL_Prefixes[i] != OpCode); i++);
    if(i == X86IL_PREFIX_COUNT)
      break;
    #undef i

    Rex = 0;

    if(OpCode == 0x66) {
      OSChanged = 1;
    }

    if(OpCode == 0x67) {
      AMChanged = 1;
    }
  }  

  if(ILength >= 16) {
    return(ILength);
  }

  if((Bits >= 0) || !(Rex & 8)) {
    if(OSChanged) {
      if(FixOpdSize == 0) {
        DefOpdSize = X86IL_OS_16;
        FixOpdSize = -2;
      }
      else {
        DefOpdSize = X86IL_OS_32;
        FixOpdSize = +0;
      }
    }
  }

  if((Bits >= 0) && AMChanged) {
    AddressMode ^= 1;
  }

//Instruction-----------------------------------------------------------------

  *pnPfx = ILength -1;
 
  if(OpCode == 0xF) {
    pAnaI[ILength] = OpCode = pOriI[ILength];
    ILength++;
    X86Idx = (OpCode >> 1) + (0x100 >> 1);
  }
  else {
    X86Idx = (OpCode >> 1) + (0x000 >> 1);
  }
  u.InstrDesc = X86ILTable[X86Idx];
  u.b >>= (OpCode & 1) << 2;

//ModRM, SIB------------------------------------------------------------------
    
  if(u.InstrDesc.IsModRM) {
    ModRMLength++;
    pAnaI[ILength] = ModRM = pOriI[ILength];
    *pModRM = ILength;
    ILength++;
    ModRMAnd7 = ModRM & 7;
    IsSIB = ModRMAnd7 == 4;
    switch(ModRM >> 6) {
      case 0  : if(AddressMode == 0) { //32bit
                  if(IsSIB) {
                    if((pOriI[ILength] & 7) == 5)
                      ModRMLength += X86IL_OS_32;
                    ModRMLength++;
                  }
                  else {
                    if(ModRMAnd7 == 5)
                      ModRMLength += X86IL_OS_32;
                  }
                }
                else { //16bit
                  if(ModRMAnd7 == 6)
                    ModRMLength += X86IL_OS_16;
                } 
                break;

      case 1  : if((AddressMode == 0) && (IsSIB)) {
                  ModRMLength++;
                }
                ModRMLength++;
                break;

      case 2  : if(AddressMode == 0) { //32bit
                  if(IsSIB) {
                    ModRMLength++;
                  } 
                  ModRMLength += X86IL_OS_32;
                }
                else { //16bit
                  ModRMLength += X86IL_OS_16;
                }
                break;

      default : ;
    }
    while(--ModRMLength) {
      pAnaI[ILength] = pOriI[ILength];
      ILength++;
    }

    if(( (OpCode & 0xFE) == 0xF6) &&
         (X86Idx         <= 0x7F) &&
         ((ModRM & 0x38) == 0x00) ) { // fix F6, F7 - TEST R/M, IMM
      OpdSize += (OpCode & 1) ? DefOpdSize : 1;
    }
  }

//Operand-----------------------------------------------------------------------

  if(u.InstrDesc.OpdSize) {
    switch(u.InstrDesc.OpdSize) {
      case X86IL_OS_32 +0  : OpdSize += X86IL_OS_32 +0 +FixOpdSize; break;
      case X86IL_OS_32 +1  : OpdSize += (((Bits < 0) && AMChanged) || AddressMode ? X86IL_OS_16 : X86IL_OS_32)*(Bits < 0 ? 2 : 1); break;
      case X86IL_OS_32 +2  : OpdSize += X86IL_OS_32 +2 +FixOpdSize; break;
      case X86IL_OS_32 +3  : OpdSize += (Rex & 8) ? X86IL_OS_32*2 : (X86IL_OS_32 +FixOpdSize); break;
      default              : OpdSize += u.InstrDesc.OpdSize;
    }
  }
  *pISize = OpdSize;

  if(OpCode == 0xF) { //3DNow!
    OpdSize++;
  }

  while(OpdSize--) {
    pAnaI[ILength] = pOriI[ILength];
    ILength++;
  }

  return(ILength);
}

//===================================================================