-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdisasm.c
1805 lines (1760 loc) · 55.4 KB
/
disasm.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// Free Disassembler and Assembler -- Disassembler
//
// Copyright (C) 2001 Oleh Yuschuk
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation; either version 2 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#define STRICT
#include <windows.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
//#include <dir.h>
#include <math.h>
#include <float.h>
#pragma hdrstop
#include "disasm.h"
////////////////////////////////////////////////////////////////////////////////
//////////////////////////// DISASSEMBLER FUNCTIONS ////////////////////////////
// Work variables of disassembler
static ulong datasize; // Size of data (1,2,4 bytes)
static ulong addrsize; // Size of address (2 or 4 bytes)
static int segprefix; // Segment override prefix or SEG_UNDEF
static int hasrm; // Command has ModR/M byte
static int hassib; // Command has SIB byte
static int dispsize; // Size of displacement (if any)
static int immsize; // Size of immediate data (if any)
static int softerror; // Noncritical disassembler error
static int ndump; // Current length of command dump
static int nresult; // Current length of disassembly
static int addcomment; // Comment value of operand
// Copy of input parameters of function Disasm()
static char* cmd; // Pointer to binary data
static char* pfixup; // Pointer to possible fixups or NULL
static ulong size; // Remaining size of the command buffer
static t_disasm* da; // Pointer to disassembly results
static int mode; // Disassembly mode (DISASM_xxx)
static int code_format;
// Disassemble name of 1, 2 or 4-byte general-purpose integer register and, if
// requested and available, dump its contents. Parameter type changes decoding
// of contents for some operand types.
// 反汇编1,2或4字节通用整数寄存器的名称，如果可用，则转储其内容
static void DecodeRG(int index, int datasize, int type)
{
int sizeindex;
char name[9] = { 0 };
if (mode < DISASM_DATA) return; // No need to decode
index &= 0x07;
if (datasize == 1)
sizeindex = 0;
else if (datasize == 2)
sizeindex = 1;
else if (datasize == 4)
sizeindex = 2;
else
{
da->error = DAE_INTERN;
return;
}
if (mode >= DISASM_FILE)
{
strcpy(name, regname[sizeindex][index]);
if (lowercase)
strlwr(name);
if (type < PSEUDOOP) // Not a pseudooperand
nresult += sprintf(da->result + nresult, "%s", name);
}
}
// Disassemble name of 80-bit floating-point register and, if available, dump
// its contents.
// 反汇编80位浮点寄存器的名称，如果可用，则转储其内容
static void DecodeST(int index, int pseudoop)
{
int i;
char s[32] = { 0 };
if (mode < DISASM_FILE) return; // No need to decode
index &= 0x07;
i = sprintf(s, "%s(%i)", (lowercase ? "st" : "ST"), index);
if (pseudoop == 0)
{
strcpy(da->result + nresult, s);
nresult += i;
}
}
// Disassemble name of 64-bit MMX register.
// 反汇编64位MMX寄存器的名称
static void DecodeMX(int index)
{
char* pr = { 0 };
if (mode < DISASM_FILE) return; // No need to decode
index &= 0x07;
pr = da->result + nresult;
nresult += sprintf(pr, "%s%i", (lowercase ? "mm" : "MM"), index);
};
// Disassemble name of 64-bit 3DNow! register and, if available, dump its
// contents.
// 反汇编64位3DNow的名称，如果可用，则转储其内容
static void DecodeNR(int index)
{
char* pr = { 0 };
if (mode < DISASM_FILE) return; // No need to decode
index &= 0x07;
pr = da->result + nresult;
nresult += sprintf(pr, "%s%i", (lowercase ? "mm" : "MM"), index);
};
// Service function, adds valid memory adress in MASM or Ideal format to
// disassembled string. Parameters: defseg - default segment for given
// register combination, descr - fully decoded register part of address,
// offset - constant part of address, dsize - data size in bytes. If global
// flag 'symbolic' is set, function also tries to decode offset as name of
// some label.
// 服务函数，将MASM或Ideal格式的有效内存地址添加到反汇编的字符串中。
//参数
//defseg - 给定寄存器组合的默认段
//descr - 地址的完全解码寄存器部分
//offset - 地址的常量部分
//dsize - 以字节为单位的数据大小
//如果设置了全局标志'symbolic'，则函数还会尝试将偏移解码为某个标签的名称。
static void Memadr(int defseg, const char* descr, long offset, int dsize)
{
int i, n, seg;
char* pr = { 0 };
char s[TEXTLEN] = { 0 };
char strformat[32] = { "%lX" };
if (mode < DISASM_FILE || descr == NULL)
return; // No need or possibility to decode
pr = da->result + nresult;
n = 0;
if (segprefix != SEG_UNDEF)
seg = segprefix;
else
seg = defseg;
if (ideal != 0) pr[n++] = '[';
// In some cases Disassembler may omit size of memory operand. Namely, flag
// showmemsize must be 0, type bit C_EXPL must be 0 (this bit namely means
// that explicit operand size is necessary) and type of command must not be
// C_MMX or C_NOW (because bit C_EXPL has in these cases different meaning).
// Otherwise, exact size must be supplied.
//在某些情况下，反汇编程序可能会忽略内存操作数的大小
//即，标志showmemsize必须为0
//类型位C_EXPL必须为0（该位即表示需要显式操作数大小）
//并且命令类型不能是C_MMX或C_NOW（因为位C_EXPL在这些情况下具有不同的含义）
//否则，必须提供确切的尺寸
if (showmemsize != 0 || (da->cmdtype & C_TYPEMASK) == C_MMX || (da->cmdtype & C_TYPEMASK) == C_NOW || (da->cmdtype & C_EXPL) != 0)
{
if (dsize < sizeof(sizename) / sizeof(sizename[0]))
n += sprintf(pr + n, "%s %s", sizename[dsize], (ideal == 0 ? "PTR " : ""));
else
n += sprintf(pr + n, "(%i-BYTE) %s", dsize, (ideal == 0 ? "PTR " : ""));
}
if ((putdefseg != 0 || seg != defseg) && seg != SEG_UNDEF)
n += sprintf(pr + n, "%s:", segname[seg]);
if (ideal == 0) pr[n++] = '[';
n += sprintf(pr + n, "%s", descr);
if (lowercase) strlwr(pr);
if (offset == 0L)
{
if (*descr == '\0') pr[n++] = '0';
}
else
{
if (symbolic && mode >= DISASM_CODE)
i = Decodeaddress(offset, s, TEXTLEN - n - 24, NULL);
else
i = 0;
if (i > 0)
{//以符号形式解码的偏移量
if (*descr != '\0') pr[n++] = '+';
strcpy(pr + n, s); n += i;
}
else
{
uchar bytearry[4] = { 0 };
uchar b = 0;
int j = 0;
if (offset<0 && offset>-16384 && *descr != '\0')
{
*(long*)bytearry = -offset;
for (j = 3; j >= 0 && bytearry[j] == 0; j--);
if (j < 0)
j = 0;
b = bytearry[j];
if (b > 0xf)
b >>= 4;
if (b > 9)
sprintf(strformat, "-0%%X");
else
sprintf(strformat, "-%%X");
if (offset > 9)
{
if (code_format == 1)
{
if (b > 9)
sprintf(strformat, "-0%%XH");
else
sprintf(strformat, "-%%XH");
}
if (code_format == 2)
{
sprintf(strformat, "-0x%%X");
}
}
n += sprintf(pr + n, strformat, -offset);
}
else
{
*(long*)bytearry = offset;
for (j = 3; j >= 0 && bytearry[j] == 0; j--); if (j < 0)j = 0;
b = bytearry[j];
if (b > 0xf)
{
b >>= 4;
}
if (b > 9)
sprintf(strformat, "0%%X");
else
sprintf(strformat, "%%X");
if (offset > 9)
{
if (code_format == 1)
{
if (b > 9)
sprintf(strformat, "0%%XH");
else
sprintf(strformat, "%%XH");
}
if (code_format == 2)
{
sprintf(strformat, "0x%%X");
}
}
if (*descr != '\0') pr[n++] = '+';
n += sprintf(pr + n, strformat, offset);
}
}
}
pr[n++] = ']';
pr[n] = '\0';
nresult += n;
};
// Disassemble memory/register from the ModRM/SIB bytes and, if available, dump
// address and contents of memory.
//从ModRM/SIB字节中反汇编内存/寄存器，如果可用，则转储内存的地址和内容
static void DecodeMR(int type)
{
int j, memonly, inmemory, seg = 0;
int c, sib;
ulong dsize, regsize, addr;
char s[TEXTLEN] = { 0 };
if (size < 2)
{
da->error = DAE_CROSS;
return;
} // ModR/M byte outside the memory block
hasrm = 1;
dsize = regsize = datasize; // Default size of addressed reg/memory
memonly = 0; // Register in ModM field is allowed
// Size and kind of addressed memory or register in ModM has no influence on
// the command size, and exact calculations are omitted if only command size
// is requested. If register is used, optype will be incorrect and we need
// to correct it later.
c = cmd[1] & 0xC7; // Leave only Mod and M fields
if (mode >= DISASM_DATA);
{
if ((c & 0xC0) == 0xC0) // Register operand
inmemory = 0;
else // Memory operand
inmemory = 1;
switch (type)
{
case MRG: // Memory/register in ModRM byte
if (inmemory)
{
if (datasize == 1) da->memtype = DEC_BYTE;
else if (datasize == 2) da->memtype = DEC_WORD;
else da->memtype = DEC_DWORD;
}
break;
case MRJ: // Memory/reg in ModRM as JUMP target
if (datasize != 2 && inmemory)
da->memtype = DEC_DWORD;
if (mode >= DISASM_FILE && shownear != 0)
nresult += sprintf(da->result + nresult, "%s ", (lowercase ? "near" : "NEAR"));
break;
case MR1: // 1-byte memory/register in ModRM byte
dsize = regsize = 1;
if (inmemory) da->memtype = DEC_BYTE;
break;
case MR2: // 2-byte memory/register in ModRM byte
dsize = regsize = 2;
if (inmemory) da->memtype = DEC_WORD;
break;
case MR4: // 4-byte memory/register in ModRM byte
case RR4: // 4-byte memory/register (register only)
dsize = regsize = 4;
if (inmemory) da->memtype = DEC_DWORD;
break;
case MR8: // 8-byte memory/MMX register in ModRM
case RR8: // 8-byte MMX register only in ModRM
dsize = 8;
if (inmemory) da->memtype = DEC_QWORD;
break;
case MRD: // 8-byte memory/3DNow! register in ModRM
case RRD: // 8-byte memory/3DNow! (register only)
dsize = 8;
if (inmemory) da->memtype = DEC_3DNOW;
break;
case MMA: // Memory address in ModRM byte for LEA
memonly = 1;
break;
case MML: // Memory in ModRM byte (for LES)
dsize = datasize + 2;
memonly = 1;
if (datasize == 4 && inmemory)
da->memtype = DEC_FWORD;
da->warnings |= DAW_SEGMENT;
break;
case MMS: // Memory in ModRM byte (as SEG:OFFS)
dsize = datasize + 2;
memonly = 1;
if (datasize == 4 && inmemory)
da->memtype = DEC_FWORD;
if (mode >= DISASM_FILE)
nresult += sprintf(da->result + nresult, "%s ", (lowercase ? "far" : "FAR"));
break;
case MM6: // Memory in ModRM (6-byte descriptor)
dsize = 6;
memonly = 1;
if (inmemory) da->memtype = DEC_FWORD;
break;
case MMB: // Two adjacent memory locations (BOUND)
dsize = (ideal ? datasize : datasize * 2);
memonly = 1;
break;
case MD2: // Memory in ModRM byte (16-bit integer)
case MB2: // Memory in ModRM byte (16-bit binary)
dsize = 2;
memonly = 1;
if (inmemory) da->memtype = DEC_WORD;
break;
case MD4: // Memory in ModRM byte (32-bit integer)
dsize = 4;
memonly = 1;
if (inmemory) da->memtype = DEC_DWORD;
break;
case MD8: // Memory in ModRM byte (64-bit integer)
dsize = 8;
memonly = 1;
if (inmemory) da->memtype = DEC_QWORD;
break;
case MDA: // Memory in ModRM byte (80-bit BCD)
dsize = 10;
memonly = 1;
if (inmemory) da->memtype = DEC_TBYTE;
break;
case MF4: // Memory in ModRM byte (32-bit float)
dsize = 4;
memonly = 1;
if (inmemory) da->memtype = DEC_FLOAT4;
break;
case MF8: // Memory in ModRM byte (64-bit float)
dsize = 8;
memonly = 1;
if (inmemory) da->memtype = DEC_FLOAT8;
break;
case MFA: // Memory in ModRM byte (80-bit float)
dsize = 10;
memonly = 1;
if (inmemory) da->memtype = DEC_FLOAT10;
break;
case MFE: // Memory in ModRM byte (FPU environment)
dsize = 28;
memonly = 1;
break;
case MFS: // Memory in ModRM byte (FPU state)
dsize = 108;
memonly = 1;
break;
case MFX: // Memory in ModRM byte (ext. FPU state)
dsize = 512;
memonly = 1;
break;
default: // Operand is not in ModM!
da->error = DAE_INTERN;
break;
}
}
addr = 0;
// There are many possibilities to decode ModM/SIB address. The first
// possibility is register in ModM - general-purpose, MMX or 3DNow!
if ((c & 0xC0) == 0xC0)
{ // Decode register operand
if (type == MR8 || type == RR8)
DecodeMX(c); // MMX register
else if (type == MRD || type == RRD)
DecodeNR(c); // 3DNow! register
else
DecodeRG(c, regsize, type); // General-purpose register
if (memonly != 0)
softerror = DAE_MEMORY; // Register where only memory allowed
return;
}
// Next possibility: 16-bit addressing mode, very seldom in 32-bit flat model
// but still supported by processor. SIB byte is never used here.
if (addrsize == 2)
{
if (c == 0x06)
{ // Special case of immediate address
dispsize = 2;
if (size < 4)
da->error = DAE_CROSS; // Disp16 outside the memory block
else if (mode >= DISASM_DATA)
{
da->adrconst = addr = *(ushort*)(cmd + 2);
if (addr == 0) da->zeroconst = 1;
seg = SEG_DS;
Memadr(seg, "", addr, dsize);
}
}
else
{
da->indexed = 1;
if ((c & 0xC0) == 0x40)
{ // 8-bit signed displacement
if (size < 3)
da->error = DAE_CROSS;
else
addr = (signed char)cmd[2] & 0xFFFF;
dispsize = 1;
}
else if ((c & 0xC0) == 0x80)
{ // 16-bit unsigned displacement
if (size < 4)
da->error = DAE_CROSS;
else
addr = *(ushort*)(cmd + 2);
dispsize = 2;
}
if (mode >= DISASM_DATA && da->error == DAE_NOERR)
{
da->adrconst = addr;
if (addr == 0) da->zeroconst = 1;
seg = addr16[c & 0x07].defseg;
Memadr(seg, addr16[c & 0x07].descr, addr, dsize);
}
}
}
// Next possibility: immediate 32-bit address.
else if (c == 0x05)
{ // Special case of immediate address
dispsize = 4;
if (size < 6)
da->error = DAE_CROSS; // Disp32 outside the memory block
else if (mode >= DISASM_DATA);
{
da->adrconst = addr = *(ulong*)(cmd + 2);
if (pfixup == NULL) pfixup = cmd + 2;
da->fixupsize += 4;
if (addr == 0) da->zeroconst = 1;
seg = SEG_DS;
Memadr(seg, "", addr, dsize);
}
}
// Next possibility: 32-bit address with SIB byte.
else if ((c & 0x07) == 0x04)
{ // SIB addresation
sib = cmd[2]; hassib = 1;
*s = '\0';
if (c == 0x04 && (sib & 0x07) == 0x05)
{
dispsize = 4; // Immediate address without base
if (size < 7)
da->error = DAE_CROSS; // Disp32 outside the memory block
else
{
da->adrconst = addr = *(ulong*)(cmd + 3);
if (pfixup == NULL) pfixup = cmd + 3;
da->fixupsize += 4;
if (addr == 0) da->zeroconst = 1;
if ((sib & 0x38) != 0x20)
{ // Index register present
da->indexed = 1;
if (type == MRJ) da->jmptable = addr;
}
seg = SEG_DS;
};
}
else
{ // Base and, eventually, displacement
if ((c & 0xC0) == 0x40)
{ // 8-bit displacement
dispsize = 1;
if (size < 4) da->error = DAE_CROSS;
else
{
da->adrconst = addr = (signed char)cmd[3];
if (addr == 0) da->zeroconst = 1;
}
}
else if ((c & 0xC0) == 0x80)
{ // 32-bit displacement
dispsize = 4;
if (size < 7)
da->error = DAE_CROSS; // Disp32 outside the memory block
else
{
da->adrconst = addr = *(ulong*)(cmd + 3);
if (pfixup == NULL) pfixup = cmd + 3;
da->fixupsize += 4;
if (addr == 0) da->zeroconst = 1;
// Most compilers use address of type [index*4+displacement] to
// address jump table (switch). But, for completeness, I allow all
// cases which include index with scale 1 or 4, base or both.
if (type == MRJ) da->jmptable = addr;
}
}
da->indexed = 1;
j = sib & 0x07;
if (mode >= DISASM_FILE)
{
strcpy(s, regname[2][j]);
seg = addr32[j].defseg;
}
};
if ((sib & 0x38) != 0x20)
{ // Scaled index present
if ((sib & 0xC0) == 0x40) da->indexed = 2;
else if ((sib & 0xC0) == 0x80) da->indexed = 4;
else if ((sib & 0xC0) == 0xC0) da->indexed = 8;
else da->indexed = 1;
}
if (mode >= DISASM_FILE && da->error == DAE_NOERR)
{
if ((sib & 0x38) != 0x20)
{ // Scaled index present
if (*s != '\0') strcat(s, "+");
strcat(s, addr32[(sib >> 3) & 0x07].descr);
if ((sib & 0xC0) == 0x40)
{
da->jmptable = 0; // Hardly a switch!
strcat(s, "*2");
}
else if ((sib & 0xC0) == 0x80)
strcat(s, "*4");
else if ((sib & 0xC0) == 0xC0)
{
da->jmptable = 0; // Hardly a switch!
strcat(s, "*8");
}
};
Memadr(seg, s, addr, dsize);
}
}
// Last possibility: 32-bit address without SIB byte.
else
{ // No SIB
if ((c & 0xC0) == 0x40)
{
dispsize = 1;
if (size < 3) da->error = DAE_CROSS; // Disp8 outside the memory block
else
{
da->adrconst = addr = (signed char)cmd[2];
if (addr == 0) da->zeroconst = 1;
}
}
else if ((c & 0xC0) == 0x80)
{
dispsize = 4;
if (size < 6)
da->error = DAE_CROSS; // Disp32 outside the memory block
else
{
da->adrconst = addr = *(ulong*)(cmd + 2);
if (pfixup == NULL) pfixup = cmd + 2;
da->fixupsize += 4;
if (addr == 0) da->zeroconst = 1;
if (type == MRJ) da->jmptable = addr;
}
}
da->indexed = 1;
if (mode >= DISASM_FILE && da->error == DAE_NOERR)
{
seg = addr32[c & 0x07].defseg;
Memadr(seg, addr32[c & 0x07].descr, addr, dsize);
}
}
}
// Disassemble implicit source of string operations and, if available, dump
// address and contents.
// 反汇编隐式字符串操作源
static void DecodeSO(void)
{
if (mode < DISASM_FILE) return; // No need to decode
if (datasize == 1) da->memtype = DEC_BYTE;
else if (datasize == 2) da->memtype = DEC_WORD;
else if (datasize == 4) da->memtype = DEC_DWORD;
da->indexed = 1;
Memadr(SEG_DS, regname[addrsize == 2 ? 1 : 2][REG_ESI], 0L, datasize);
}
// Disassemble implicit destination of string operations and, if available,
// dump address and contents. Destination always uses segment ES, and this
// setting cannot be overridden.
// 反汇编字符串操作的隐式目标，如果可用，则转储地址和内容
// 目标始终使用段ES，并且无法覆盖此设置
static void DecodeDE(void)
{
int seg;
if (mode < DISASM_FILE) return; // No need to decode
if (datasize == 1) da->memtype = DEC_BYTE;
else if (datasize == 2) da->memtype = DEC_WORD;
else if (datasize == 4) da->memtype = DEC_DWORD;
da->indexed = 1;
seg = segprefix; segprefix = SEG_ES; // Fake Memadr by changing segment prefix
Memadr(SEG_DS, regname[addrsize == 2 ? 1 : 2][REG_EDI], 0L, datasize);
segprefix = seg; // Restore segment prefix
}
// Decode XLAT operand and, if available, dump address and contents.
// 解码XLAT操作数
static void DecodeXL(void)
{
if (mode < DISASM_FILE) return; // No need to decode
da->memtype = DEC_BYTE;
da->indexed = 1;
Memadr(SEG_DS, (addrsize == 2 ? "BX+AL" : "EBX+AL"), 0L, 1);
}
// Decode immediate operand of size constsize. If sxt is non-zero, byte operand
// should be sign-extended to sxt bytes. If type of immediate constant assumes
// this, small negative operands may be displayed as signed negative numbers.
// Note that in most cases immediate operands are not shown in comment window.
// 解码大小constsize的立即操作数
// 如果sxt非零，则应将字节操作数符号扩展为sxt字节
// 如果立即常数的类型假定为此，则小的负操作数可以显示为带符号的负数
// 请注意，在大多数情况下，注释窗口中不会显示立即操作数
static void DecodeIM(int constsize, int sxt, int type)
{
int i;
signed long data;
ulong l;
char name[TEXTLEN] = { 0 }, comment[TEXTLEN] = { 0 };//修复问题
immsize += constsize; // Allows several immediate operands
if (mode < DISASM_DATA) return;
l = 1 + hasrm + hassib + dispsize + (immsize - constsize);
data = 0;
if (size < l + constsize)
da->error = DAE_CROSS;
else if (constsize == 1)
{
if (sxt == 0) data = (uchar)cmd[l];
else data = (signed char)cmd[l];
if (type == IMS && ((data & 0xE0) != 0 || data == 0))
{
da->warnings |= DAW_SHIFT;
da->cmdtype |= C_RARE;
}
}
else if (constsize == 2)
{
if (sxt == 0) data = *(ushort*)(cmd + l);
else data = *(short*)(cmd + l);
}
else
{
data = *(long*)(cmd + l);
if (pfixup == NULL) pfixup = cmd + l;
da->fixupsize += 4;
}
if (sxt == 2) data &= 0x0000FFFF;
if (data == 0 && da->error == 0) da->zeroconst = 1;
// Command ENTER, as an exception from Intel's rules, has two immediate
// constants. As the second constant is rarely used, I exclude it from
// search if the first constant is non-zero (which is usually the case).
// 作为Intel规则的一个例外，Command ENTER有两个立即常量
// 由于第二个常量很少使用，如果第一个常量非零（通常是这种情况），我会将其从搜索中排除。
if (da->immconst == 0)
da->immconst = data;
if (mode >= DISASM_FILE && da->error == DAE_NOERR)
{
if (mode >= DISASM_CODE && type != IMU)
i = Decodeaddress(data, name, TEXTLEN - nresult - 24, comment);
else
{
i = 0; comment[0] = '\0';
}
if (i != 0 && symbolic != 0)
{
strcpy(da->result + nresult, name);
nresult += i;
}
else
{
char strformat1[32] = { "-%lX" };
char strformat2[32] = { "%lX" };
uchar bytearry[4] = { 0 };
uchar b = 0;
int j = 0;
if (data<0 && data>-0xff)
*(long*)bytearry = -data;
else
*(long*)bytearry = data;
for (j = 3; j >= 0 && bytearry[j] == 0; j--);
if (j < 0)j = 0;
b = bytearry[j];
if (b > 0xf)
b >>= 4;
if (b > 9)
{
sprintf(strformat1, "-0%%X");
sprintf(strformat2, "0%%X");
}
else
{
sprintf(strformat1, "-%%X");
sprintf(strformat2, "%%X");
}
if (*(DWORD*)bytearry > 9)
{
if (code_format == 1)
{
if (code_format && b > 9)
{
sprintf(strformat1, "-0%%XH");
sprintf(strformat2, "0%%XH");
}
else
{
sprintf(strformat1, "-%%XH");
sprintf(strformat2, "%%XH");
}
}
if (code_format == 2)
{
sprintf(strformat1, "-0x%%X");
sprintf(strformat2, "0x%%X");
}
}
if (type == IMU || type == IMS || type == IM2 || data >= 0 || data < NEGLIMIT)
{
if (data<0 && data>-0xff)
nresult += sprintf(da->result + nresult, strformat1, -data);
else
nresult += sprintf(da->result + nresult, strformat2, data);
}
else
nresult += sprintf(da->result + nresult, strformat1, -data);
}
if (addcomment && comment[0] != '\0') strcpy(da->comment, comment);
}
}
// Decode VxD service name (always 4-byte).
// 解码VxD服务名称（始终为4字节）
static void DecodeVX(void)
{
ulong l, data;
immsize += 4; // Allows several immediate operands
if (mode < DISASM_DATA) return;
l = 1 + hasrm + hassib + dispsize + (immsize - 4);
if (size < l + 4)
{
da->error = DAE_CROSS;
return;
}
data = *(long*)(cmd + l);
if (data == 0 && da->error == 0) da->zeroconst = 1;
if (da->immconst == 0)
da->immconst = data;
if (mode >= DISASM_FILE && da->error == DAE_NOERR)
{
if ((data & 0x00008000) != 0 && memicmp("VxDCall", da->result, 7) == 0)
memcpy(da->result, lowercase ? "vxdjump" : "VxDJump", 7);
nresult += sprintf(da->result + nresult, "%lX", data);
}
}
// Decode implicit constant 1 (used in shift commands). This operand is so
// insignificant that it is never shown in comment window.
// 解码隐式常量1（用于移位命令）
//这个操作数是如此微不足道，以至于它从未在评论窗口中显示。
static void DecodeC1(void)
{
if (mode < DISASM_DATA) return;
da->immconst = 1;
if (mode >= DISASM_FILE) nresult += sprintf(da->result + nresult, "1");
}
// Decode immediate absolute data address. This operand is used in 8080-
// compatible commands which allow to move data from memory to accumulator and
// back. Note that bytes ModRM and SIB never appear in commands with IA operand.
// 解码立即绝对数据地址
// 该操作数用于8080兼容命令，允许将数据从内存移动到累加器和后端
// 请注意，字节ModRM和SIB永远不会出现在带有IA操作数的命令中
static void DecodeIA(void)
{
ulong addr;
if (size < 1 + addrsize)
{
da->error = DAE_CROSS; return;
}
dispsize = addrsize;
if (mode < DISASM_DATA) return;
if (datasize == 1) da->memtype = DEC_BYTE;
else if (datasize == 2) da->memtype = DEC_WORD;
else if (datasize == 4) da->memtype = DEC_DWORD;
if (addrsize == 2)
addr = *(ushort*)(cmd + 1);
else
{
addr = *(ulong*)(cmd + 1);
if (pfixup == NULL) pfixup = cmd + 1;
da->fixupsize += 4;
}
da->adrconst = addr;
if (addr == 0) da->zeroconst = 1;
if (mode >= DISASM_FILE)
{
Memadr(SEG_DS, "", addr, datasize);
}
};
// Decodes jump relative to nextip of size offsize.
////解码相对于大小为offsize的nextip的跳转。
static void DecodeRJ(ulong offsize, ulong nextip)
{
int i;
ulong addr;
char s[TEXTLEN] = { 0 };
if (size < offsize + 1)
{
da->error = DAE_CROSS;
return;
}
dispsize = offsize; // Interpret offset as displacement
if (mode < DISASM_DATA)
return;
if (offsize == 1)
addr = (signed char)cmd[1] + nextip;
else if (offsize == 2)
addr = *(signed short*)(cmd + 1) + nextip;
else
addr = *(ulong*)(cmd + 1) + nextip;
if (datasize == 2)
addr &= 0xFFFF;
da->jmpconst = addr;
if (addr == 0) da->zeroconst = 1;
if (mode >= DISASM_FILE)
{
if (offsize == 1) nresult += sprintf(da->result + nresult, "%s ", (lowercase == 0 ? "SHORT" : "short"));
if (mode >= DISASM_CODE)
i = Decodeaddress(addr, s, TEXTLEN, da->comment);
else
i = 0;
if (symbolic == 0 || i == 0)
{
uchar bytearry[4] = { 0 };
*(ulong*)bytearry = addr;
uchar b = 0;
int j;
for (j = 3; j >= 0 && bytearry[j] == 0; j--); if (j < 0)j = 0;
b = bytearry[j];
if (b > 0xf)
{
b >>= 4;
}
char strformat[16];
if (b > 9)
{
sprintf(strformat, "0%%%dX", j * 2);
if (code_format == 1)
sprintf(strformat, "0%%%dXH", j * 2);
if (code_format == 2)
sprintf(strformat, "0x%%%dX", j * 2);
}
else
{
sprintf(strformat, "%%%dX", j * 2);
if (code_format == 1)
sprintf(strformat, "%%%dXH", j * 2);
if (code_format == 2)
sprintf(strformat, "0x%%%dX", j * 2);
}
nresult += sprintf(da->result + nresult, strformat, addr);
}
else
nresult += sprintf(da->result + nresult, "%.*s", TEXTLEN - nresult - 25, s);
if (symbolic == 0 && i != 0 && da->comment[0] == '\0')
strcpy(da->comment, s);
}
}
// Decode immediate absolute far jump address. In flat model, such addresses
// are not used (mostly because selector is specified directly in the command),
// so I neither decode as symbol nor comment it. To allow search for selector
// by value, I interprete it as an immediate constant.
// 解码立即绝对远跳地址
// 在平面模型中，不使用这样的地址（主要是因为选择器直接在命令中指定），所以我既不解码为符号也不对其进行注释
// 为了允许按值搜索选择器，我将其解释为立即数。
static void DecodeJF(void)
{
ulong addr, seg;
if (size < 1 + addrsize + 2)
{
da->error = DAE_CROSS;
return;
}
dispsize = addrsize;
immsize = 2; // Non-trivial but allowed interpretation
if (mode < DISASM_DATA) return;
if (addrsize == 2)
{
addr = *(ushort*)(cmd + 1);
seg = *(ushort*)(cmd + 3);
}
else
{
addr = *(ulong*)(cmd + 1);
seg = *(ushort*)(cmd + 5);
}
da->jmpconst = addr;
da->immconst = seg;
if (addr == 0 || seg == 0) da->zeroconst = 1;
if (mode >= DISASM_FILE)
{
nresult += sprintf(da->result + nresult, "%s %04X:%08X", (lowercase == 0 ? "FAR" : "far"), seg, addr);
}
}
// Decode segment register. In flat model, operands of this type are seldom.
// 解码段寄存器。 在平面模型中，这种类型的操作数很少。
static void DecodeSG(int index)
{
int i;
if (mode < DISASM_DATA) return;
index &= 0x07;
if (index >= 6) softerror = DAE_BADSEG; // Undefined segment register
if (mode >= DISASM_FILE)
{
i = sprintf(da->result + nresult, "%s", segname[index]);
if (lowercase) strlwr(da->result + nresult);
nresult += i;
}
}
// Decode control register addressed in R part of ModRM byte. Operands of
// this type are extremely rare. Contents of control registers are accessible
// only from privilege level 0, so I cannot dump them here.
// 解码ModRM字节的R部分中寻址的控制寄存器。 这种类型的操作数极为罕见。
// 控制寄存器的内容只能从权限级别0访问，所以我不能在这里转储它们。
static void DecodeCR(int index)
{
hasrm = 1;
if (mode >= DISASM_FILE)
{
index = (index >> 3) & 0x07;
nresult += sprintf(da->result + nresult, "%s", crname[index]);
if (lowercase) strlwr(da->result + nresult);
}
}
// Decode debug register addressed in R part of ModRM byte. Operands of
// this type are extremely rare. I can dump only those debug registers
// available in CONTEXT structure
// 解码在ModRM字节的R部分寻址的调试寄存器。
// 这种类型的操作数极为罕见。 我只能转储CONTEXT结构中可用的调试寄存器