| 1 |
/* |
| 2 |
* mon_x86.cpp - 80x86 disassembler |
| 3 |
* |
| 4 |
* (C) 1998-1999 Christian Bauer |
| 5 |
*/ |
| 6 |
|
| 7 |
#include <stdio.h> |
| 8 |
#include <string.h> |
| 9 |
|
| 10 |
#include "mon.h" |
| 11 |
#include "mon_x86.h" |
| 12 |
|
| 13 |
|
| 14 |
// Memory access functions |
| 15 |
static uint16 read_uint16(uint8 *&m) |
| 16 |
{ |
| 17 |
uint16 val = (m[1] << 8) | m[0]; |
| 18 |
m += 2; |
| 19 |
return val; |
| 20 |
} |
| 21 |
|
| 22 |
static int16 read_int16(uint8 *&m) |
| 23 |
{ |
| 24 |
int16 val = (m[1] << 8) | m[0]; |
| 25 |
m += 2; |
| 26 |
return val; |
| 27 |
} |
| 28 |
|
| 29 |
static uint32 read_uint32(uint8 *&m) |
| 30 |
{ |
| 31 |
uint32 val = (m[3] << 24) | (m[2] << 16) | (m[1] << 8) | m[0]; |
| 32 |
m += 4; |
| 33 |
return val; |
| 34 |
} |
| 35 |
|
| 36 |
|
| 37 |
// String constants |
| 38 |
static const char *gp_reg[2][8] = { |
| 39 |
"ax", "cx", "dx", "bx", "sp", "bp", "si", "di", |
| 40 |
"eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi" |
| 41 |
}; |
| 42 |
|
| 43 |
|
| 44 |
// Prototypes |
| 45 |
static void disass0f(char *&mnem, char *s, uint8 *&m, bool &mode32); |
| 46 |
|
| 47 |
|
| 48 |
/* |
| 49 |
* Disassemble one instruction, return number of bytes |
| 50 |
*/ |
| 51 |
|
| 52 |
int disass_x86(FILE *f, uint32 adr, uint8 *m) |
| 53 |
{ |
| 54 |
uint8 *orig_m = m; |
| 55 |
char *mnem; |
| 56 |
char s[256] = ""; |
| 57 |
bool mode32 = true; |
| 58 |
int32 disp; |
| 59 |
|
| 60 |
// Decode primary opcode |
| 61 |
next_opcode: |
| 62 |
uint8 opcode = *m++; |
| 63 |
switch (opcode) { |
| 64 |
case 0x04: |
| 65 |
mnem = "add"; |
| 66 |
arith_alimm: |
| 67 |
sprintf(s, "al,$%02x", *m++); |
| 68 |
break; |
| 69 |
case 0x05: |
| 70 |
mnem = "add"; |
| 71 |
arith_aximm: |
| 72 |
if (mode32) |
| 73 |
sprintf(s, "eax,$%08lx", read_uint32(m)); |
| 74 |
else |
| 75 |
sprintf(s, "ax,$%04x", read_uint16(m)); |
| 76 |
break; |
| 77 |
|
| 78 |
case 0x06: mnem = "push\tes"; break; |
| 79 |
case 0x07: mnem = "pop\tes"; break; |
| 80 |
case 0x0c: mnem = "or"; goto arith_alimm; |
| 81 |
case 0x0d: mnem = "or"; goto arith_aximm; |
| 82 |
case 0x0e: mnem = "push\tcs"; break; |
| 83 |
case 0x0f: disass0f(mnem, s, m, mode32); break; |
| 84 |
case 0x14: mnem = "adc"; goto arith_alimm; |
| 85 |
case 0x15: mnem = "adc"; goto arith_aximm; |
| 86 |
case 0x16: mnem = "push\tss"; break; |
| 87 |
case 0x17: mnem = "pop\tss"; break; |
| 88 |
case 0x1c: mnem = "sbb"; goto arith_alimm; |
| 89 |
case 0x1d: mnem = "sbb"; goto arith_aximm; |
| 90 |
case 0x1e: mnem = "push\tds"; break; |
| 91 |
case 0x1f: mnem = "pop\tds"; break; |
| 92 |
case 0x24: mnem = "and"; goto arith_alimm; |
| 93 |
case 0x25: mnem = "and"; goto arith_aximm; |
| 94 |
case 0x26: mnem = "(seg es prefix)"; break; |
| 95 |
case 0x27: mnem = "daa"; break; |
| 96 |
case 0x2c: mnem = "sub"; goto arith_alimm; |
| 97 |
case 0x2d: mnem = "sub"; goto arith_aximm; |
| 98 |
case 0x2e: mnem = "(seg cs prefix)"; break; |
| 99 |
case 0x2f: mnem = "das"; break; |
| 100 |
case 0x34: mnem = "xor"; goto arith_alimm; |
| 101 |
case 0x35: mnem = "xor"; goto arith_aximm; |
| 102 |
case 0x36: mnem = "(seg ss prefix)"; break; |
| 103 |
case 0x37: mnem = "aaa"; break; |
| 104 |
case 0x3c: mnem = "cmp"; goto arith_alimm; |
| 105 |
case 0x3d: mnem = "cmp"; goto arith_aximm; |
| 106 |
case 0x3e: mnem = "(seg ds prefix)"; break; |
| 107 |
case 0x3f: mnem = "aas"; break; |
| 108 |
|
| 109 |
case 0x40: case 0x41: case 0x42: case 0x43: case 0x44: case 0x45: case 0x46: case 0x47: |
| 110 |
mnem = "inc"; sprintf(s, "%s", gp_reg[mode32][opcode & 7]); break; |
| 111 |
case 0x48: case 0x49: case 0x4a: case 0x4b: case 0x4c: case 0x4d: case 0x4e: case 0x4f: |
| 112 |
mnem = "dec"; sprintf(s, "%s", gp_reg[mode32][opcode & 7]); break; |
| 113 |
case 0x50: case 0x51: case 0x52: case 0x53: case 0x54: case 0x55: case 0x56: case 0x57: |
| 114 |
mnem = "push"; sprintf(s, "%s", gp_reg[mode32][opcode & 7]); break; |
| 115 |
case 0x58: case 0x59: case 0x5a: case 0x5b: case 0x5c: case 0x5d: case 0x5e: case 0x5f: |
| 116 |
mnem = "pop"; sprintf(s, "%s", gp_reg[mode32][opcode & 7]); break; |
| 117 |
|
| 118 |
case 0x60: mnem = mode32 ? "pushad" : "pusha"; break; |
| 119 |
case 0x61: mnem = mode32 ? "popad" : "popa"; break; |
| 120 |
case 0x64: mnem = "(seg fs prefix)"; break; |
| 121 |
case 0x65: mnem = "(seg gs prefix)"; break; |
| 122 |
case 0x66: mode32 = !mode32; goto next_opcode; //!! error checking |
| 123 |
case 0x67: mnem = "(adr size prefix)"; break; |
| 124 |
|
| 125 |
case 0x70: |
| 126 |
mnem = "jo"; |
| 127 |
jcc_bdisp: |
| 128 |
disp = (int8)*m++; |
| 129 |
sprintf(s, "$%08lx", disp + adr + (m - orig_m)); |
| 130 |
break; |
| 131 |
case 0x71: mnem = "jno"; goto jcc_bdisp; |
| 132 |
case 0x72: mnem = "jc"; goto jcc_bdisp; |
| 133 |
case 0x73: mnem = "jnc"; goto jcc_bdisp; |
| 134 |
case 0x74: mnem = "je"; goto jcc_bdisp; |
| 135 |
case 0x75: mnem = "jne"; goto jcc_bdisp; |
| 136 |
case 0x76: mnem = "jbe"; goto jcc_bdisp; |
| 137 |
case 0x77: mnem = "jnbe"; goto jcc_bdisp; |
| 138 |
case 0x78: mnem = "js"; goto jcc_bdisp; |
| 139 |
case 0x79: mnem = "jns"; goto jcc_bdisp; |
| 140 |
case 0x7a: mnem = "jpe"; goto jcc_bdisp; |
| 141 |
case 0x7b: mnem = "jpo"; goto jcc_bdisp; |
| 142 |
case 0x7c: mnem = "jl"; goto jcc_bdisp; |
| 143 |
case 0x7d: mnem = "jge"; goto jcc_bdisp; |
| 144 |
case 0x7e: mnem = "jle"; goto jcc_bdisp; |
| 145 |
case 0x7f: mnem = "jg"; goto jcc_bdisp; |
| 146 |
|
| 147 |
case 0x90: mnem = "nop"; break; |
| 148 |
case 0x91: case 0x92: case 0x93: case 0x94: case 0x95: case 0x96: case 0x97: |
| 149 |
mnem = "xchg"; sprintf(s, "%s,%s", mode32 ? "eax" : "ax", gp_reg[mode32][opcode & 7]); break; |
| 150 |
|
| 151 |
case 0x98: mnem = mode32 ? "cwde" : "cbw"; break; |
| 152 |
case 0x99: mnem = mode32 ? "cdq" : "cwd"; break; |
| 153 |
case 0x9b: mnem = "wait"; break; |
| 154 |
case 0x9c: mnem = mode32 ? "pushfd" : "pushf"; break; |
| 155 |
case 0x9d: mnem = mode32 ? "popfd" : "popf"; break; |
| 156 |
case 0x9e: mnem = "sahf"; break; |
| 157 |
case 0x9f: mnem = "lahf"; break; |
| 158 |
case 0xa0: mnem = "mov"; sprintf(s, "al,byte ptr $%08lx", read_uint32(m)); break; |
| 159 |
case 0xa1: mnem = "mov"; sprintf(s, mode32 ? "eax,dword ptr $%08lx" : "ax,word ptr $%08x", read_uint32(m)); break; |
| 160 |
case 0xa2: mnem = "mov"; sprintf(s, "byte ptr $%08lx,al", read_uint32(m)); break; |
| 161 |
case 0xa3: mnem = "mov"; sprintf(s, mode32 ? "dword ptr $%08lx,eax" : "word ptr $%08x,ax", read_uint32(m)); break; |
| 162 |
case 0xa4: mnem = "movsb"; break; |
| 163 |
case 0xa5: mnem = mode32 ? "movsd" : "movsw"; break; |
| 164 |
case 0xa6: mnem = "cmpsb"; break; |
| 165 |
case 0xa7: mnem = mode32 ? "cmpsd" : "cmpsw"; break; |
| 166 |
case 0xa8: mnem = "test"; goto arith_alimm; |
| 167 |
case 0xa9: mnem = "test"; goto arith_aximm; |
| 168 |
case 0xaa: mnem = "stosb"; break; |
| 169 |
case 0xab: mnem = mode32 ? "stosd" : "stosw"; break; |
| 170 |
case 0xac: mnem = "lodsb"; break; |
| 171 |
case 0xad: mnem = mode32 ? "lodsd" : "lodsw"; break; |
| 172 |
case 0xae: mnem = "scasb"; break; |
| 173 |
case 0xaf: mnem = mode32 ? "scasd" : "scasw"; break; |
| 174 |
case 0xb0: mnem = "mov"; sprintf(s, "al,$%02x", *m++); break; |
| 175 |
case 0xb1: mnem = "mov"; sprintf(s, "cl,$%02x", *m++); break; |
| 176 |
case 0xb2: mnem = "mov"; sprintf(s, "dl,$%02x", *m++); break; |
| 177 |
case 0xb3: mnem = "mov"; sprintf(s, "bl,$%02x", *m++); break; |
| 178 |
case 0xb4: mnem = "mov"; sprintf(s, "ah,$%02x", *m++); break; |
| 179 |
case 0xb5: mnem = "mov"; sprintf(s, "ch,$%02x", *m++); break; |
| 180 |
case 0xb6: mnem = "mov"; sprintf(s, "dh,$%02x", *m++); break; |
| 181 |
case 0xb7: mnem = "mov"; sprintf(s, "bh,$%02x", *m++); break; |
| 182 |
|
| 183 |
case 0xb8: case 0xb9: case 0xba: case 0xbb: case 0xbc: case 0xbd: case 0xbe: case 0xbf: |
| 184 |
mnem = "mov"; |
| 185 |
if (mode32) |
| 186 |
sprintf(s, "%s,$%08lx", gp_reg[true][opcode & 7], read_uint32(m)); |
| 187 |
else |
| 188 |
sprintf(s, "%s,$%04x", gp_reg[false][opcode & 7], read_uint16(m)); |
| 189 |
break; |
| 190 |
|
| 191 |
case 0xc2: mnem = "ret"; sprintf(s, "near $%04x", read_uint16(m)); break; |
| 192 |
case 0xc3: mnem = "ret\tnear"; break; |
| 193 |
case 0xc9: mnem = "leave"; break; |
| 194 |
case 0xca: mnem = "ret"; sprintf(s, "far $%04x", read_uint16(m)); break; |
| 195 |
case 0xcb: mnem = "ret\tfar"; break; |
| 196 |
case 0xcc: mnem = "int3"; break; |
| 197 |
case 0xcd: mnem = "int"; sprintf(s, "$%02x", *m++); break; |
| 198 |
case 0xce: mnem = "into"; break; |
| 199 |
case 0xcf: mnem = "iret"; break; |
| 200 |
case 0xd4: mnem = "aam"; m++; break; |
| 201 |
case 0xd5: mnem = "aad"; m++; break; |
| 202 |
case 0xd7: mnem = "xlat"; break; |
| 203 |
case 0xe0: mnem = "loopnz"; goto jcc_bdisp; |
| 204 |
case 0xe1: mnem = "loopz"; goto jcc_bdisp; |
| 205 |
case 0xe2: mnem = "loop"; goto jcc_bdisp; |
| 206 |
case 0xe3: mnem = mode32 ? "jecxz" : "jcxz"; goto jcc_bdisp; |
| 207 |
case 0xe4: mnem = "in"; sprintf(s, "al,$%02x", *m++); break; |
| 208 |
case 0xe5: mnem = "in"; sprintf(s, "%s,$%02x", mode32 ? "eax" : "ax", *m++); break; |
| 209 |
case 0xe6: mnem = "out"; sprintf(s, "$%02x,al", *m++); break; |
| 210 |
case 0xe7: mnem = "out"; sprintf(s, "$%02x,%s", *m++, mode32 ? "eax" : "ax"); break; |
| 211 |
|
| 212 |
case 0xe8: |
| 213 |
mnem = "call"; |
| 214 |
jump_near: |
| 215 |
disp = read_uint32(m); |
| 216 |
sprintf(s, "near $%08lx", disp + adr + (m - orig_m)); |
| 217 |
break; |
| 218 |
case 0xe9: mnem = "jmp"; goto jump_near; |
| 219 |
case 0xeb: |
| 220 |
mnem = "jmp"; |
| 221 |
disp = (int8)*m++; |
| 222 |
sprintf(s, "near $%08lx", disp + adr + (m - orig_m)); |
| 223 |
break; |
| 224 |
|
| 225 |
case 0xec: mnem = "in\tal,dx"; break; |
| 226 |
case 0xed: mnem = mode32 ? "in\teax,dx" : "in\tax,dx"; break; |
| 227 |
case 0xee: mnem = "out\tdx,al"; break; |
| 228 |
case 0xef: mnem = mode32 ? "out\tdx,eax" : "out\tdx,ax"; break; |
| 229 |
case 0xf0: mnem = "lock"; break; |
| 230 |
case 0xf2: mnem = "repne"; break; |
| 231 |
case 0xf3: mnem = "rep"; break; |
| 232 |
case 0xf4: mnem = "hlt"; break; |
| 233 |
case 0xf5: mnem = "cmc"; break; |
| 234 |
case 0xf8: mnem = "clc"; break; |
| 235 |
case 0xf9: mnem = "stc"; break; |
| 236 |
case 0xfa: mnem = "cli"; break; |
| 237 |
case 0xfb: mnem = "sti"; break; |
| 238 |
case 0xfc: mnem = "cld"; break; |
| 239 |
case 0xfd: mnem = "std"; break; |
| 240 |
|
| 241 |
default: |
| 242 |
mnem = "?"; |
| 243 |
break; |
| 244 |
} |
| 245 |
|
| 246 |
// Print opcodes and mnemonics |
| 247 |
int size = m - orig_m; |
| 248 |
for (int i=0; i<7; i++) |
| 249 |
if (i < size) |
| 250 |
fprintf(f, "%02x ", orig_m[i]); |
| 251 |
else |
| 252 |
fprintf(f, " "); |
| 253 |
fprintf(f, "%s\t%s\n", mnem, s); |
| 254 |
return size; |
| 255 |
} |
| 256 |
|
| 257 |
|
| 258 |
/* |
| 259 |
* Disassemble instruction with primary opcode 0x0f |
| 260 |
*/ |
| 261 |
|
| 262 |
static void disass0f(char *&mnem, char *s, uint8 *&m, bool &mode32) |
| 263 |
{ |
| 264 |
// Decode secondary opcode |
| 265 |
uint8 opcode = *m++; |
| 266 |
switch (opcode) { |
| 267 |
case 0x06: mnem = "clts"; break; |
| 268 |
case 0x08: mnem = "invd"; break; |
| 269 |
case 0x09: mnem = "wbinvd"; break; |
| 270 |
case 0x0b: mnem = "ud2"; break; |
| 271 |
case 0x30: mnem = "wrmsr"; break; |
| 272 |
case 0x31: mnem = "rdtsc"; break; |
| 273 |
case 0x32: mnem = "rdmsr"; break; |
| 274 |
case 0x33: mnem = "rdpmc"; break; |
| 275 |
case 0xa0: mnem = "push\tfs"; break; |
| 276 |
case 0xa1: mnem = "pop\tfs"; break; |
| 277 |
case 0xa2: mnem = "cpuid"; break; |
| 278 |
case 0xa8: mnem = "push\tgs"; break; |
| 279 |
case 0xa9: mnem = "pop\tgs"; break; |
| 280 |
case 0xaa: mnem = "rsm"; break; |
| 281 |
|
| 282 |
case 0xc8: case 0xc9: case 0xca: case 0xcb: case 0xcc: case 0xcd: case 0xce: case 0xcf: |
| 283 |
mnem = "bswap"; sprintf(s, "%s", gp_reg[true][opcode & 7]); break; |
| 284 |
|
| 285 |
default: |
| 286 |
mnem = "?"; |
| 287 |
break; |
| 288 |
} |
| 289 |
} |
