0
mirror of https://github.com/sampletext32/ParkanPlayground.git synced 2025-06-19 16:08:02 +03:00

Fixes to tests and ModRM + SIB

This commit is contained in:
bird_egop
2025-04-17 20:06:18 +03:00
parent 7c0e6d7f3a
commit 124493cd94
17 changed files with 215 additions and 188 deletions

View File

@ -23,7 +23,14 @@ public class AddEaxImmHandler : InstructionHandler
/// <returns>True if this handler can decode the opcode</returns>
public override bool CanHandle(byte opcode)
{
return opcode == 0x05;
// ADD EAX, imm32 is encoded as 0x05 without 0x66 prefix
if (opcode != 0x05)
{
return false;
}
// Only handle when the operand size prefix is NOT present
return !Decoder.HasOperandSizePrefix();
}
/// <summary>

View File

@ -23,7 +23,14 @@ public class AndEaxImmHandler : InstructionHandler
/// <returns>True if this handler can decode the opcode</returns>
public override bool CanHandle(byte opcode)
{
return opcode == 0x25;
// AND EAX, imm32 is encoded as 0x25 without 0x66 prefix
if (opcode != 0x25)
{
return false;
}
// Only handle when the operand size prefix is NOT present
return !Decoder.HasOperandSizePrefix();
}
/// <summary>

View File

@ -23,16 +23,19 @@ public class IdivRm32Handler : InstructionHandler
/// <returns>True if this handler can decode the opcode</returns>
public override bool CanHandle(byte opcode)
{
// IDIV r/m32 is encoded as 0xF7 with reg field 7
if (opcode != 0xF7)
return false;
// Check if the reg field of the ModR/M byte is 7 (IDIV)
// Check if we can read the ModR/M byte
if (!Decoder.CanReadByte())
return false;
// Check if the reg field of the ModR/M byte is 7 (IDIV)
var reg = ModRMDecoder.PeakModRMReg();
return reg == 7; // 7 = IDIV
// reg = 7 means IDIV operation
return reg == 7;
}
/// <summary>
@ -54,7 +57,13 @@ public class IdivRm32Handler : InstructionHandler
// Read the ModR/M byte
// For IDIV r/m32 (0xF7 /7):
// - The r/m field with mod specifies the operand (register or memory)
var (_, _, _, operand) = ModRMDecoder.ReadModRM();
var (mod, reg, rm, operand) = ModRMDecoder.ReadModRM();
// Verify that the reg field is 7 (IDIV)
if (reg != RegisterIndex.Di)
{
return false;
}
// Set the structured operands
// IDIV has only one operand

View File

@ -80,21 +80,22 @@ public class InstructionHandlerFactory
RegisterImulHandlers(); // IMUL instructions
RegisterDivHandlers(); // DIV instructions
RegisterIdivHandlers(); // IDIV instructions
RegisterDataTransferHandlers();
RegisterJumpHandlers();
RegisterCallHandlers();
RegisterReturnHandlers();
RegisterDecHandlers();
RegisterDataTransferHandlers(); // MOV, MOVZX, MOVSX
RegisterJumpHandlers(); // JMP instructions
RegisterCallHandlers(); // CALL instructions
RegisterReturnHandlers(); // RET instructions
RegisterDecHandlers(); // DEC instructions
RegisterIncHandlers(); // INC/DEC handlers after Group 1 handlers
RegisterPushHandlers();
RegisterPopHandlers();
RegisterLeaHandlers();
RegisterFloatingPointHandlers();
RegisterStringHandlers();
RegisterMovHandlers();
RegisterPushHandlers(); // PUSH instructions
RegisterPopHandlers(); // POP instructions
RegisterLeaHandlers(); // LEA instructions
RegisterFloatingPointHandlers(); // FPU instructions
RegisterStringHandlers(); // String instructions
RegisterMovHandlers(); // MOV instructions
RegisterSubHandlers(); // Register SUB handlers
RegisterNopHandlers(); // Register NOP handlers
RegisterBitHandlers(); // Register bit manipulation handlers
RegisterAndHandlers(); // Register AND handlers
}
/// <summary>
@ -168,9 +169,9 @@ public class InstructionHandlerFactory
_handlers.Add(new JmpRm32Handler(_decoder)); // JMP r/m32 (opcode FF /4)
// Conditional jump handlers
_handlers.Add(new JgeRel8Handler(_decoder));
_handlers.Add(new ConditionalJumpHandler(_decoder));
_handlers.Add(new TwoByteConditionalJumpHandler(_decoder));
_handlers.Add(new JgeRel8Handler(_decoder)); // JGE rel8 (opcode 0F 8D)
_handlers.Add(new ConditionalJumpHandler(_decoder)); // Short conditional jumps
_handlers.Add(new TwoByteConditionalJumpHandler(_decoder)); // Long conditional jumps
}
/// <summary>
@ -179,12 +180,12 @@ public class InstructionHandlerFactory
private void RegisterTestHandlers()
{
// TEST handlers
_handlers.Add(new TestImmWithRm32Handler(_decoder));
_handlers.Add(new TestImmWithRm8Handler(_decoder));
_handlers.Add(new TestRegMem8Handler(_decoder));
_handlers.Add(new TestRegMemHandler(_decoder));
_handlers.Add(new TestAlImmHandler(_decoder));
_handlers.Add(new TestEaxImmHandler(_decoder));
_handlers.Add(new TestImmWithRm32Handler(_decoder)); // TEST r/m32, imm32 (opcode A9)
_handlers.Add(new TestImmWithRm8Handler(_decoder)); // TEST r/m8, imm8 (opcode F6 /0)
_handlers.Add(new TestRegMem8Handler(_decoder)); // TEST r8, r/m8 (opcode 84 /0)
_handlers.Add(new TestRegMemHandler(_decoder)); // TEST r32, r/m32 (opcode 85 /0)
_handlers.Add(new TestAlImmHandler(_decoder)); // TEST AL, imm8 (opcode A8)
_handlers.Add(new TestEaxImmHandler(_decoder)); // TEST EAX, imm32 (opcode A9)
}
/// <summary>
@ -243,7 +244,7 @@ public class InstructionHandlerFactory
private void RegisterLeaHandlers()
{
// Add Lea handlers
_handlers.Add(new LeaR32MHandler(_decoder));
_handlers.Add(new LeaR32MHandler(_decoder)); // LEA r32, m (opcode 8D)
}
/// <summary>
@ -252,21 +253,21 @@ public class InstructionHandlerFactory
private void RegisterCmpHandlers()
{
// Add Cmp handlers for 32-bit operands
_handlers.Add(new CmpR32Rm32Handler(_decoder));
_handlers.Add(new CmpRm32R32Handler(_decoder));
_handlers.Add(new CmpR32Rm32Handler(_decoder)); // CMP r32, r/m32 (opcode 3B)
_handlers.Add(new CmpRm32R32Handler(_decoder)); // CMP r/m32, r32 (opcode 39)
// Add Cmp handlers for 8-bit operands
_handlers.Add(new CmpRm8R8Handler(_decoder)); // CMP r/m8, r8 (opcode 38)
_handlers.Add(new CmpR8Rm8Handler(_decoder)); // CMP r8, r/m8 (opcode 3A)
// Add Cmp handlers for immediate operands
_handlers.Add(new CmpImmWithRm8Handler(_decoder));
_handlers.Add(new CmpImmWithRm8Handler(_decoder)); // CMP r/m8, imm8 (opcode 80 /7)
_handlers.Add(new CmpAlImmHandler(_decoder)); // CMP AL, imm8 (opcode 3C)
_handlers.Add(new CmpEaxImmHandler(_decoder)); // CMP EAX, imm32 (opcode 3D)
// Add CMP immediate handlers from ArithmeticImmediate namespace
_handlers.Add(new CmpImmWithRm32Handler(_decoder));
_handlers.Add(new CmpImmWithRm32SignExtendedHandler(_decoder));
_handlers.Add(new CmpImmWithRm32Handler(_decoder)); // CMP r/m32, imm32 (opcode 81 /7)
_handlers.Add(new CmpImmWithRm32SignExtendedHandler(_decoder)); // CMP r/m32, imm8 (opcode 83 /7)
}
/// <summary>
@ -275,7 +276,9 @@ public class InstructionHandlerFactory
private void RegisterDecHandlers()
{
// Add Dec handlers
_handlers.Add(new DecRegHandler(_decoder));
_handlers.Add(new DecRegHandler(_decoder)); // DEC r/m8 (opcode FE)
// _handlers.Add(new DecMem8Handler(_decoder)); // DEC r/m16 (opcode FF /1) and DEC r/m32 (opcode FF /1)
}
/// <summary>
@ -284,7 +287,9 @@ public class InstructionHandlerFactory
private void RegisterIncHandlers()
{
// Add Inc handlers
_handlers.Add(new IncRegHandler(_decoder));
_handlers.Add(new IncRegHandler(_decoder)); // INC r/m8 (opcode FE)
// _handlers.Add(new IncMem8Handler(_decoder)); // INC r/m16 (opcode FF /0) and INC r/m32 (opcode FF /0)
}
/// <summary>
@ -295,7 +300,8 @@ public class InstructionHandlerFactory
// Add ADD register-to-register handlers (32-bit)
_handlers.Add(new AddR32Rm32Handler(_decoder)); // ADD r32, r/m32 (opcode 03)
_handlers.Add(new AddRm32R32Handler(_decoder)); // ADD r/m32, r32 (opcode 01)
_handlers.Add(new AddEaxImmHandler(_decoder)); // ADD EAX, imm32 (opcode 05)
_handlers.Add(new AddEaxImmHandler(_decoder)); // ADD EAX, imm32 (opcode 05 without 0x66 prefix)
_handlers.Add(new AddAxImmHandler(_decoder)); // ADD AX, imm16 (opcode 05 with 0x66 prefix)
// Add ADD register-to-register handlers (16-bit)
_handlers.Add(new AddR16Rm16Handler(_decoder)); // ADD r16, r/m16 (opcode 03 with 0x66 prefix)
@ -320,17 +326,17 @@ public class InstructionHandlerFactory
private void RegisterDataTransferHandlers()
{
// Add MOV handlers
_handlers.Add(new MovRegMemHandler(_decoder));
_handlers.Add(new MovMemRegHandler(_decoder));
_handlers.Add(new MovRegImm32Handler(_decoder));
_handlers.Add(new MovRegImm8Handler(_decoder));
_handlers.Add(new MovEaxMoffsHandler(_decoder));
_handlers.Add(new MovMoffsEaxHandler(_decoder));
_handlers.Add(new MovRm32Imm32Handler(_decoder));
_handlers.Add(new MovRm8Imm8Handler(_decoder));
_handlers.Add(new MovRegMemHandler(_decoder)); // MOV r32, r/m32 (opcode 8B)
_handlers.Add(new MovMemRegHandler(_decoder)); // MOV r/m32, r32 (opcode 89)
_handlers.Add(new MovRegImm32Handler(_decoder)); // MOV r32, imm32 (opcode B8 + register)
_handlers.Add(new MovRegImm8Handler(_decoder)); // MOV r32, imm8 (opcode B0 + register)
_handlers.Add(new MovEaxMoffsHandler(_decoder)); // MOV EAX, moffs32 (opcode A1)
_handlers.Add(new MovMoffsEaxHandler(_decoder)); // MOV moffs32, EAX (opcode A3)
_handlers.Add(new MovRm32Imm32Handler(_decoder)); // MOV r/m32, imm32 (opcode C7 /0)
_handlers.Add(new MovRm8Imm8Handler(_decoder)); // MOV r/m8, imm8 (opcode C6 /0)
// Add XCHG handlers
_handlers.Add(new XchgEaxRegHandler(_decoder));
_handlers.Add(new XchgEaxRegHandler(_decoder)); // XCHG EAX, r32 (opcode 90 + register)
}
/// <summary>
@ -339,15 +345,15 @@ public class InstructionHandlerFactory
private void RegisterFloatingPointHandlers()
{
// Add Floating Point handlers
_handlers.Add(new FnstswHandler(_decoder));
_handlers.Add(new Float32OperationHandler(_decoder));
_handlers.Add(new LoadStoreControlHandler(_decoder));
_handlers.Add(new Int32OperationHandler(_decoder));
_handlers.Add(new LoadStoreInt32Handler(_decoder));
_handlers.Add(new Float64OperationHandler(_decoder));
_handlers.Add(new LoadStoreFloat64Handler(_decoder));
_handlers.Add(new Int16OperationHandler(_decoder));
_handlers.Add(new LoadStoreInt16Handler(_decoder));
_handlers.Add(new FnstswHandler(_decoder)); // FSTSW (opcode DF /7)
_handlers.Add(new Float32OperationHandler(_decoder)); // Floating Point operations on 32-bit values
_handlers.Add(new LoadStoreControlHandler(_decoder)); // Load and store control words (opcode D9 /0)
_handlers.Add(new Int32OperationHandler(_decoder)); // Integer operations on 32-bit values
_handlers.Add(new LoadStoreInt32Handler(_decoder)); // Load and store 32-bit values
_handlers.Add(new Float64OperationHandler(_decoder)); // Floating Point operations on 64-bit values
_handlers.Add(new LoadStoreFloat64Handler(_decoder)); // Load and store 64-bit values
_handlers.Add(new Int16OperationHandler(_decoder)); // Integer operations on 16-bit values
_handlers.Add(new LoadStoreInt16Handler(_decoder)); // Load and store 16-bit values
}
/// <summary>
@ -407,24 +413,29 @@ public class InstructionHandlerFactory
}
/// <summary>
/// Registers all And instruction handlers
/// Registers all AND instruction handlers
/// </summary>
private void RegisterAndHandlers()
{
// Add AND immediate handlers
_handlers.Add(new AndImmToRm8Handler(_decoder)); // AND r/m8, imm8 (opcode 80 /4)
_handlers.Add(new AndImmToRm32Handler(_decoder)); // AND r/m32, imm32 (opcode 81 /4)
_handlers.Add(new AndImmToRm32SignExtendedHandler(_decoder)); // AND r/m32, imm8 (opcode 83 /4)
// Add AND register handlers
// 16-bit handlers with operand size prefix (must come first)
_handlers.Add(new AndAxImmHandler(_decoder)); // AND AX, imm16 (opcode 25 with 0x66 prefix)
_handlers.Add(new AndImmToRm16Handler(_decoder)); // AND r/m16, imm16 (opcode 81 /4 with 0x66 prefix)
_handlers.Add(new AndImmToRm16SignExtendedHandler(_decoder)); // AND r/m16, imm8 (opcode 83 /4 with 0x66 prefix)
_handlers.Add(new AndRm16R16Handler(_decoder)); // AND r/m16, r16 (opcode 21 with 0x66 prefix)
_handlers.Add(new AndR16Rm16Handler(_decoder)); // AND r16, r/m16 (opcode 23 with 0x66 prefix)
// 8-bit handlers
_handlers.Add(new AndAlImmHandler(_decoder)); // AND AL, imm8 (opcode 24)
_handlers.Add(new AndR8Rm8Handler(_decoder)); // AND r8, r/m8 (opcode 22)
_handlers.Add(new AndRm8R8Handler(_decoder)); // AND r/m8, r8 (opcode 20)
_handlers.Add(new AndImmToRm8Handler(_decoder)); // AND r/m8, imm8 (opcode 80 /4)
// 32-bit handlers
_handlers.Add(new AndEaxImmHandler(_decoder)); // AND EAX, imm32 (opcode 25 without 0x66 prefix)
_handlers.Add(new AndR32Rm32Handler(_decoder)); // AND r32, r/m32 (opcode 23)
_handlers.Add(new AndMemRegHandler(_decoder)); // AND r/m32, r32 (opcode 21)
// Add AND immediate with accumulator handlers
_handlers.Add(new AndAlImmHandler(_decoder)); // AND AL, imm8 (opcode 24)
_handlers.Add(new AndEaxImmHandler(_decoder)); // AND EAX, imm32 (opcode 25)
_handlers.Add(new AndImmToRm32Handler(_decoder)); // AND r/m32, imm32 (opcode 81 /4)
_handlers.Add(new AndImmToRm32SignExtendedHandler(_decoder)); // AND r/m32, imm8 (opcode 83 /4)
}
/// <summary>
@ -435,23 +446,23 @@ public class InstructionHandlerFactory
// Register SUB handlers
// 16-bit handlers with operand size prefix (must come first)
_handlers.Add(new SubAxImm16Handler(_decoder));
_handlers.Add(new SubImmFromRm16Handler(_decoder));
_handlers.Add(new SubImmFromRm16SignExtendedHandler(_decoder));
_handlers.Add(new SubRm16R16Handler(_decoder));
_handlers.Add(new SubR16Rm16Handler(_decoder));
_handlers.Add(new SubAxImm16Handler(_decoder)); // SUB AX, imm16 (opcode 0x66 0x83 /5)
_handlers.Add(new SubImmFromRm16Handler(_decoder)); // SUB r/m16, imm16 (opcode 0x66 0x81 /5)
_handlers.Add(new SubImmFromRm16SignExtendedHandler(_decoder)); // SUB r/m16, imm8 (opcode 0x66 0x83 /5)
_handlers.Add(new SubRm16R16Handler(_decoder)); // SUB r/m16, r16 (opcode 0x66 0x29)
_handlers.Add(new SubR16Rm16Handler(_decoder)); // SUB r16, r/m16 (opcode 0x66 0x2B)
// 32-bit handlers
_handlers.Add(new SubRm32R32Handler(_decoder));
_handlers.Add(new SubR32Rm32Handler(_decoder));
_handlers.Add(new SubImmFromRm32Handler(_decoder));
_handlers.Add(new SubImmFromRm32SignExtendedHandler(_decoder));
_handlers.Add(new SubRm32R32Handler(_decoder)); // SUB r/m32, r32 (opcode 0x29)
_handlers.Add(new SubR32Rm32Handler(_decoder)); // SUB r32, r/m32 (opcode 0x2B)
_handlers.Add(new SubImmFromRm32Handler(_decoder)); // SUB r/m32, imm32 (opcode 0x81 /5)
_handlers.Add(new SubImmFromRm32SignExtendedHandler(_decoder)); // SUB r/m32, imm8 (opcode 0x83 /5)
// 8-bit handlers
_handlers.Add(new SubRm8R8Handler(_decoder));
_handlers.Add(new SubR8Rm8Handler(_decoder));
_handlers.Add(new SubAlImm8Handler(_decoder));
_handlers.Add(new SubImmFromRm8Handler(_decoder));
_handlers.Add(new SubRm8R8Handler(_decoder)); // SUB r/m8, r8 (opcode 0x28)
_handlers.Add(new SubR8Rm8Handler(_decoder)); // SUB r8, r/m8 (opcode 0x2A)
_handlers.Add(new SubAlImm8Handler(_decoder)); // SUB AL, imm8 (opcode 0x2C)
_handlers.Add(new SubImmFromRm8Handler(_decoder)); // SUB r/m8, imm8 (opcode 0x80 /5)
}
/// <summary>
@ -460,9 +471,9 @@ public class InstructionHandlerFactory
private void RegisterNopHandlers()
{
// Register NOP handlers
_handlers.Add(new NopHandler(_decoder));
_handlers.Add(new TwoByteNopHandler(_decoder));
_handlers.Add(new MultiByteNopHandler(_decoder));
_handlers.Add(new NopHandler(_decoder)); // NOP (opcode 0x90)
_handlers.Add(new TwoByteNopHandler(_decoder)); // 2-byte NOP (opcode 0x66 0x90)
_handlers.Add(new MultiByteNopHandler(_decoder)); // Multi-byte NOP (opcode 0F 1F /0)
}
/// <summary>
@ -491,16 +502,15 @@ public class InstructionHandlerFactory
_handlers.Add(new BsrR32Rm32Handler(_decoder)); // BSR r32, r/m32 (0F BD)
}
/// <summary>
/// Registers all NEG instruction handlers
/// </summary>
private void RegisterNegHandlers()
{
// NEG r/m8 handler (F6 /3)
_handlers.Add(new NegRm8Handler(_decoder));
// NEG r/m32 handler (F7 /3)
_handlers.Add(new NegRm32Handler(_decoder));
_handlers.Add(new NegRm8Handler(_decoder)); // NEG r/m8 handler (F6 /3)
_handlers.Add(new NegRm32Handler(_decoder)); // NEG r/m32 handler (F7 /3)
}
/// <summary>
@ -508,11 +518,8 @@ public class InstructionHandlerFactory
/// </summary>
private void RegisterMulHandlers()
{
// MUL r/m8 handler (F6 /4)
_handlers.Add(new MulRm8Handler(_decoder));
// MUL r/m32 handler (F7 /4)
_handlers.Add(new MulRm32Handler(_decoder));
_handlers.Add(new MulRm8Handler(_decoder)); // MUL r/m8 handler (F6 /4)
_handlers.Add(new MulRm32Handler(_decoder)); // MUL r/m32 handler (F7 /4)
}
/// <summary>
@ -520,11 +527,8 @@ public class InstructionHandlerFactory
/// </summary>
private void RegisterNotHandlers()
{
// NOT r/m8 handler (F6 /2)
_handlers.Add(new NotRm8Handler(_decoder));
// NOT r/m32 handler (F7 /2)
_handlers.Add(new NotRm32Handler(_decoder));
_handlers.Add(new NotRm8Handler(_decoder)); // NOT r/m8 handler (F6 /2)
_handlers.Add(new NotRm32Handler(_decoder)); // NOT r/m32 handler (F7 /2)
}
/// <summary>
@ -532,20 +536,12 @@ public class InstructionHandlerFactory
/// </summary>
private void RegisterImulHandlers()
{
// IMUL r/m8 handler (F6 /5)
_handlers.Add(new ImulRm8Handler(_decoder));
_handlers.Add(new ImulRm8Handler(_decoder)); // IMUL r/m8 handler (F6 /5)
_handlers.Add(new ImulRm32Handler(_decoder)); // IMUL r/m32 handler (F7 /5)
// IMUL r/m32 handler (F7 /5)
_handlers.Add(new ImulRm32Handler(_decoder));
// IMUL r32, r/m32 handler (0F AF /r)
_handlers.Add(new ImulR32Rm32Handler(_decoder));
// IMUL r32, r/m32, imm8 handler (6B /r ib)
_handlers.Add(new ImulR32Rm32Imm8Handler(_decoder));
// IMUL r32, r/m32, imm32 handler (69 /r id)
_handlers.Add(new ImulR32Rm32Imm32Handler(_decoder));
_handlers.Add(new ImulR32Rm32Handler(_decoder)); // IMUL r32, r/m32 handler (0F AF /r)
_handlers.Add(new ImulR32Rm32Imm8Handler(_decoder)); // IMUL r32, r/m32, imm8 handler (6B /r ib)
_handlers.Add(new ImulR32Rm32Imm32Handler(_decoder)); // IMUL r32, r/m32, imm32 handler (69 /r id)
}
/// <summary>
@ -553,11 +549,8 @@ public class InstructionHandlerFactory
/// </summary>
private void RegisterDivHandlers()
{
// DIV r/m8 handler (F6 /6)
_handlers.Add(new DivRm8Handler(_decoder));
// DIV r/m32 handler (F7 /6)
_handlers.Add(new DivRm32Handler(_decoder));
_handlers.Add(new DivRm8Handler(_decoder)); // DIV r/m8 handler (F6 /6)
_handlers.Add(new DivRm32Handler(_decoder)); // DIV r/m32 handler (F7 /6)
}
/// <summary>
@ -565,11 +558,8 @@ public class InstructionHandlerFactory
/// </summary>
private void RegisterIdivHandlers()
{
// IDIV r/m8 handler (F6 /7)
_handlers.Add(new IdivRm8Handler(_decoder));
// IDIV r/m32 handler (F7 /7)
_handlers.Add(new IdivRm32Handler(_decoder));
_handlers.Add(new IdivRm8Handler(_decoder)); // IDIV r/m8 handler (F6 /7)
_handlers.Add(new IdivRm32Handler(_decoder)); // IDIV r/m32 handler (F7 /7)
}
/// <summary>

View File

@ -43,7 +43,6 @@ public class InstructionDecoder
// Create specialized decoders
_prefixDecoder = new PrefixDecoder();
new ModRMDecoder(this);
// Create the instruction handler factory
_handlerFactory = new InstructionHandlerFactory(_codeBuffer, this, _length);
@ -101,7 +100,7 @@ public class InstructionDecoder
Printer.WriteLine?.Invoke($"Resolved handler {handler?.GetType().Name}");
bool handlerSuccess = false;
bool handlerSuccess;
// Try to decode with a handler first
if (handler != null)
@ -115,6 +114,11 @@ public class InstructionDecoder
// Decode the instruction
handlerSuccess = handler.Decode(opcode, instruction);
if (!handlerSuccess)
{
Printer.WriteLine?.Invoke($"Handler {handler.GetType().Name} failed!");
}
// Apply segment override prefix to the structured operands if needed
if (handlerSuccess && hasSegmentOverride)
{

View File

@ -77,7 +77,7 @@ public class ModRMDecoder
if (_decoder.CanReadByte())
{
byte sib = _decoder.ReadByte();
return _sibDecoder.DecodeSIB(sib, 0, operandSize);
return _sibDecoder.DecodeSIB(sib, 0, operandSize, mod);
}
// Fallback for incomplete data
@ -95,7 +95,7 @@ public class ModRMDecoder
{
byte sib = _decoder.ReadByte();
sbyte disp8 = (sbyte)(_decoder.CanReadByte() ? _decoder.ReadByte() : 0);
return _sibDecoder.DecodeSIB(sib, (uint)disp8, operandSize);
return _sibDecoder.DecodeSIB(sib, (uint)disp8, operandSize, mod);
}
// Fallback for incomplete data
@ -108,6 +108,7 @@ public class ModRMDecoder
sbyte disp8 = (sbyte)_decoder.ReadByte();
// Always create a displacement memory operand for mod=1, even if displacement is 0
// This ensures we show exactly what's encoded in the ModR/M byte
return OperandFactory.CreateDisplacementMemoryOperand(rmIndex, disp8, operandSize);
}
@ -123,7 +124,7 @@ public class ModRMDecoder
{
byte sib = _decoder.ReadByte();
uint disp32 = _decoder.ReadUInt32();
return _sibDecoder.DecodeSIB(sib, disp32, operandSize);
return _sibDecoder.DecodeSIB(sib, disp32, operandSize, mod);
}
// Fallback for incomplete data
@ -143,11 +144,7 @@ public class ModRMDecoder
return OperandFactory.CreateDisplacementMemoryOperand(rmIndex, (long)disp32, operandSize);
}
// Only show displacement if it's not zero
if (disp32 == 0)
{
return OperandFactory.CreateBaseRegisterMemoryOperand(rmIndex, operandSize);
}
// Always include the displacement, even if it's zero, to match the encoding
// Cast to long to preserve the unsigned value for large displacements
return OperandFactory.CreateDisplacementMemoryOperand(rmIndex, (long)disp32, operandSize);

View File

@ -24,8 +24,9 @@ public class SIBDecoder
/// <param name="sib">The SIB byte</param>
/// <param name="displacement">The displacement value</param>
/// <param name="operandSize">The size of the operand in bits (8, 16, 32, or 64)</param>
/// <param name="mod">The mod field from the ModR/M byte</param>
/// <returns>The decoded SIB operand</returns>
public Operand DecodeSIB(byte sib, uint displacement, int operandSize)
public Operand DecodeSIB(byte sib, uint displacement, int operandSize, byte mod = 0)
{
// Extract fields from SIB byte
byte scale = (byte)((sib & Constants.SIB_SCALE_MASK) >> 6);
@ -39,8 +40,8 @@ public class SIBDecoder
// Special case: ESP/SP (4) in index field means no index register
if (index == RegisterIndex.Sp)
{
// Special case: EBP/BP (5) in base field with no displacement means disp32 only
if (@base == RegisterIndex.Bp && displacement == 0)
// Special case: EBP/BP (5) in base field with mod=00 means disp32 only
if (@base == RegisterIndex.Bp && mod == 0)
{
if (_decoder.CanReadUInt())
{
@ -56,16 +57,12 @@ public class SIBDecoder
}
// When index is ESP (no index), we just have a base register with optional displacement
if (displacement == 0)
{
return OperandFactory.CreateBaseRegisterMemoryOperand(@base, operandSize);
}
// Always include the displacement, even if it's zero, to match the encoding
return OperandFactory.CreateDisplacementMemoryOperand(@base, (int)displacement, operandSize);
}
// Special case: EBP/BP (5) in base field with no displacement means disp32 only
if (@base == RegisterIndex.Bp && displacement == 0)
// Special case: EBP/BP (5) in base field with mod=00 means disp32 only
if (@base == RegisterIndex.Bp && mod == 0 && displacement == 0)
{
if (_decoder.CanReadUInt())
{
@ -98,6 +95,22 @@ public class SIBDecoder
operandSize);
}
// Special case: When base is EBP/BP and mod is 01 or 10
// This is a special case in x86 addressing.
if (@base == RegisterIndex.Bp && (mod == 1 || mod == 2))
{
int scaleFactorBp = 1 << scale; // 1, 2, 4, or 8
// Always include the displacement for EBP, even if it's zero
// This ensures we show exactly what's encoded in the ModR/M and SIB bytes
return OperandFactory.CreateScaledIndexMemoryOperand(
index,
scaleFactorBp,
@base,
(int)displacement,
operandSize);
}
// Normal case with base and index registers
int scaleFactor = 1 << scale; // 1, 2, 4, or 8