| View previous topic :: View next topic |
| Author |
Message |
haha01haha01 Grandmaster Cheater Supreme
Reputation: 0
Joined: 15 Jun 2007 Posts: 1233 Location: http://www.SaviourFagFails.com/
|
Posted: Mon Sep 15, 2008 8:20 am Post subject: Analyzing assembler commands |
|
|
lets say i got a batch of bytes, and i want to translate them into the names of their assembler commands (e.g. byte 90 would translate to "nop"), how do i do it the faster and most efficient way?
i know that basically i need a dll that will recieve the integer and output the name of the command it holds, but i dont really feel like going into making tousands of cases for each option. is there any ready-to-go dll or source code that does that? i tried looking into CE source but got pretty confused after 10 lines.
|
|
| Back to top |
|
 |
DoomsDay Grandmaster Cheater
Reputation: 0
Joined: 06 Jan 2007 Posts: 768 Location: %HomePath%
|
Posted: Mon Sep 15, 2008 2:19 pm Post subject: |
|
|
The common method is to use data tables, which define the characteristics of each bye (for example: if it's a mandatory, belongs to a group\escape opcode, it's reg table, reg encoding etc).
My suggestion to you is to look up GNU Binutils.
|
|
| Back to top |
|
 |
BanMe Master Cheater
Reputation: 0
Joined: 29 Nov 2005 Posts: 375 Location: Farmington NH, USA
|
Posted: Mon Sep 15, 2008 3:08 pm Post subject: |
|
|
OllyDbg Comes with a nice dll extension with source that the version that is public is somewhat lacking in the way is interprets opcodes it is a very nice utility to have, the one way i can think of to generate correct coding output would be to disasmble by section(Section type(Data or code)) if data then read whole DWORD as internal address if code then just disasmble as normal ... this should fix a few of the disasmbly problems but unfortunatly code references data and in these locations some other form of correct disasmbly will have to take place... but yea
http ':' '\'\' ollydbg.de should have the source on the page ;p
+ Google IS YOUR FREIND!!...
Greetz BanMe ;d
|
|
| Back to top |
|
 |
rapion124 Grandmaster Cheater Supreme
Reputation: 0
Joined: 25 Mar 2007 Posts: 1095
|
Posted: Mon Sep 15, 2008 3:17 pm Post subject: |
|
|
| Easiest way is to get Intel's opcode manual. Then, create a table with 255 entries (1 for each byte). Fill the table with info such as length, description, etc. Then, it's really easy. Say you wanted to look up 0x90, then you just go to OpcodeTable[0x90].Description and get the description.
|
|
| Back to top |
|
 |
DoomsDay Grandmaster Cheater
Reputation: 0
Joined: 06 Jan 2007 Posts: 768 Location: %HomePath%
|
Posted: Mon Sep 15, 2008 3:25 pm Post subject: |
|
|
| rapion124 wrote: | | Easiest way is to get Intel's opcode manual. Then, create a table with 255 entries (1 for each byte). Fill the table with info such as length, description, etc. Then, it's really easy. Say you wanted to look up 0x90, then you just go to OpcodeTable[0x90].Description and get the description. | What about the escape opcodes? :S
As for a nice example of this implementation:
http://www.geocities.com/~sangcho/disasm.html
|
|
| Back to top |
|
 |
|