 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Deltron Z
Expert Cheater
![]() Reputation: 1
Joined: 14 Jun 2009
Posts: 164
|
 Posted: Wed Mar 31, 2010 5:43 am Post subject: [C]Disassembler |
 |
|
I'm trying to write my own disassembler, just for practice and pehaps even for furure use.
I'm using this website to get all commands and bytes, but I'm having trouble.
First, I'd like to ask what does "rmX" (X is 8, 16 or 32, representing number of bits) stand for, is it register-memory? (PTR [REG]?)
Can it also be a pointer of the form [REG+REG*4] or even [REG+IMM]?
Currently, I have a big array containing (some, now only basics like JMP, MOV and ADD) structures of type Instruction:
| Code: | struct Instruction
{
const char* Name;
int Length;
int Opcode;
OperandType Operand1;
OperandType Operand2;
}; |
Since opcode (excluding operands) cannot exceed 3 bytes, I'm using a 32-bit integer for the opcode, stored in Little-Endian.
Now, I've tried to run my DisassemblerInstruction function with the opcode 0x80 with 0x00 0x00 which represent ADD BYTE PTR [EAX], 0 but I'm getting ADC BYTE PTR [EAX], 0 instead.
I know why this happens, becuase both ADD and ADC opcode's are 0x80, and since ADC is first in the list it's opcode is found and chosen first.
So far I've been treating the first byte of the first operand as the first operand register, but seeing that the second byte is shared for both opcode and first operand it's complicating things - there are also cases where there's only one byte for both operands, such as ADD REG, REG.
I'm not really sure how to solve this, since I haven't finished adding all instructions to the list and their properties/rules, if you'd like, but what I've thought of is to add each operand an index to represent the starting bit of the register's code.
For instance, bit-index = 0 represents that bits 0 through 2 (inclusive) contain information about the register (binary code index where EAX = 000b and EDI = 111b), or bit-index = 8 means bits 0 through 2 of the next byte, but I was wondering if there's any better solution other than adding 2 more variables to the structure.
Here's my OperandType enumeration:
| Code: | enum OperandType
{
none, //No operand
imm8, //Constant 8-bits integer memory
imm16, //Constant 16-bits integer memory
imm32, //Constant 32-bits integer memory
reg8, //8-bit register
reg16, //16-bit register
reg32, //32-bit register
regA, //Accumulator register, size is dependent on second operand
rm8, //Register memory BYTE PTR [REG]
rm16, //Register memory WORD PTR [REG]
rm32, //Register memory DWORD PTR [REG]
rel8, //Relative byte
rel16, //Relative word
rel32, //Relative dword
memoffs8, //Memory offset BYTE PTR [ADDRESS]
memoffs16, //Memory offset WORD PTR [ADDRESS]
memoffs32, //Memory offset DWORD PTR [ADDRESS]
seg //Segment
//cr, //Control Register
//dr, //Debug Register
}; |
Still unfinished, is anything else needed? is anything else needed for Instruction structure?
Thanks in advance.  |
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 475
Joined: 09 May 2003
Posts: 25973
Location: The netherlands
|
| Posted: Wed Mar 31, 2010 7:29 am Post subject: |
|
|
check the reg field of the modrm byte (the byte following 0x80, bits 3 to 5)
if it's 0, it's ADD, if it's 2 it's ADC
anyhow, just add in an extra check that if it's set it makes use of the reg field as opcode extension
e.g: if 0x80, then it uses the regfield as an opcode extension
also, the documents I prefer(they even have a layout of the modrm and sib fields, including the rex prefix for 64-bit):
http://www.intel.com/Assets/PDF/manual/253666.pdf
http://www.intel.com/Assets/PDF/manual/253667.pdf
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
