开发者

Numbers of opcodes in instruction

Is there any other (faster) way to get it? x86 architecture Here is what i wrote so far.

 #include <cstdio>
#include <cstdlib>

typedef unsigned int UINT;
typ开发者_如何学Pythonedef unsigned char BYTE;

BYTE getInstructionLength(BYTE * data);

int main()
{

    //get mod 
    //hex:bin 0x00:00 0xC0:11 0x40:01 0x80:10
    //printf("opcode 0x%X  mod: 0x%X\n", opcode, opcode&0xC0);
    //get r
    //hex:bin 0x28:101 0x30:110 0x8:001
    //printf("opcode 0x%X  reg: 0x%X\n", opcode, opcode&0x38);
    //get m
    //hex:bin 0x07:111 0x2:010 0x1:001 0x6:110 0x0:000 0x3:011 0x4:100 0x5 101
    //printf("opcode 0x%X  R/M: 0x%X\n", opcode, opcode&0x07);

    for(BYTE opcode=0x0; opcode < 255; opcode++)
    {
        printf("opcode 0x%X mod: 0x%X  reg:0x%X  M:0x%X\n", opcode, opcode&0xC0, opcode&0x38, opcode&0x07);
    }
    return 0;
}

BYTE getInstructionLength(BYTE * data)
{
    if(data[0] >= 0x3F && data[0] <= 0x61) return 1; //one opcode instructions
    switch(data[0])
    {
    case 0x00:
        switch(data[1])
        {
        case 0x00: return 2; //ADD BYTE PTR DS:[EAX],AL
        case 0x01: return 2; //ADD BYTE PTR DS:[ECX],AL
        case 0x02: return 2; //ADD BYTE PTR DS:[EDX],AL 
        case 0x03: return 2; //ADD BYTE PTR DS:[EBX],AL
        case 0x04: if(data[2]&0x07 == 0x5) return 7; else return 3; //always 7 if R/M = 101 
        case 0x05: return 6;
        case 0x06: return 2;
        case 0x07: return 2;
        case 0x08: return 2;
        case 0x09: return 2;
        case 0x0A: return 2;
        case 0x0B: return 2;
        case 0x0C: if(data[2]&0x07 == 0x5) return 7; else return 3;
        }
        case 0x06: return 1; //push es
        case 0x07: return 1; //pop es
        case 0x16: return 1; //push ss
        case 0x17: return 1; //pop ss
        case 0x90: return 1; //nop
    }
}


If you need to be able to compute the instruction length in bytes for x86, then you could look for
length-disassembler on Z0mbie's page: http://z0mbie.daemonlab.org/

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜