mirror of
https://github.com/sampletext32/ParkanPlayground.git
synced 2025-05-21 21:01:17 +03:00
remove more special cases. use standardized api
This commit is contained in:
parent
c9e854a663
commit
157171fa90
@ -62,28 +62,14 @@ public class Disassembler
|
|||||||
}
|
}
|
||||||
|
|
||||||
/// <summary>
|
/// <summary>
|
||||||
/// Disassembles the code buffer and returns the disassembled instructions
|
/// Handles the special case of segment override prefixes followed by FF 75 XX (PUSH dword ptr [ebp+XX])
|
||||||
/// </summary>
|
/// </summary>
|
||||||
/// <returns>A list of disassembled instructions</returns>
|
/// <param name="decoder">The instruction decoder</param>
|
||||||
public List<Instruction> Disassemble()
|
/// <param name="position">The current position in the buffer</param>
|
||||||
|
/// <returns>The special instruction, or null if not applicable</returns>
|
||||||
|
private Instruction? HandleSegmentPushSpecialCase(InstructionDecoder decoder, int position)
|
||||||
{
|
{
|
||||||
List<Instruction> instructions = new List<Instruction>();
|
// Check if we have the pattern: segment prefix + FF 75 XX
|
||||||
|
|
||||||
// Create an instruction decoder
|
|
||||||
InstructionDecoder decoder = new InstructionDecoder(_codeBuffer, _length);
|
|
||||||
|
|
||||||
// Decode instructions until the end of the buffer is reached
|
|
||||||
while (true)
|
|
||||||
{
|
|
||||||
int position = decoder.GetPosition();
|
|
||||||
|
|
||||||
// Check if we've reached the end of the buffer
|
|
||||||
if (position >= _length)
|
|
||||||
{
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Special case for segment override prefixes followed by FF 75 XX (PUSH dword ptr [ebp+XX])
|
|
||||||
if (position + 3 < _length &&
|
if (position + 3 < _length &&
|
||||||
IsSegmentOverridePrefix(_codeBuffer[position]) &&
|
IsSegmentOverridePrefix(_codeBuffer[position]) &&
|
||||||
_codeBuffer[position + 1] == 0xFF &&
|
_codeBuffer[position + 1] == 0xFF &&
|
||||||
@ -103,16 +89,23 @@ public class Disassembler
|
|||||||
RawBytes = new byte[] { segmentPrefix, 0xFF, 0x75, displacement }
|
RawBytes = new byte[] { segmentPrefix, 0xFF, 0x75, displacement }
|
||||||
};
|
};
|
||||||
|
|
||||||
instructions.Add(specialInstruction);
|
|
||||||
|
|
||||||
// Skip past this instruction
|
// Skip past this instruction
|
||||||
decoder.SetPosition(position + 4);
|
decoder.SetPosition(position + 4);
|
||||||
|
|
||||||
// Continue with the next instruction
|
return specialInstruction;
|
||||||
continue;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Special case for segment override prefixes
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
/// <summary>
|
||||||
|
/// Handles the special case of segment override prefixes
|
||||||
|
/// </summary>
|
||||||
|
/// <param name="decoder">The instruction decoder</param>
|
||||||
|
/// <param name="position">The current position in the buffer</param>
|
||||||
|
/// <returns>The instruction with segment override, or null if not applicable</returns>
|
||||||
|
private Instruction? HandleSegmentOverridePrefix(InstructionDecoder decoder, int position)
|
||||||
|
{
|
||||||
// If the current byte is a segment override prefix and we have at least 2 bytes
|
// If the current byte is a segment override prefix and we have at least 2 bytes
|
||||||
if (position + 1 < _length && IsSegmentOverridePrefix(_codeBuffer[position]))
|
if (position + 1 < _length && IsSegmentOverridePrefix(_codeBuffer[position]))
|
||||||
{
|
{
|
||||||
@ -157,30 +150,29 @@ public class Disassembler
|
|||||||
// Adjust the instruction address to include the base address
|
// Adjust the instruction address to include the base address
|
||||||
baseInstruction.Address = (uint)(savedPosition) + _baseAddress;
|
baseInstruction.Address = (uint)(savedPosition) + _baseAddress;
|
||||||
|
|
||||||
// Add the instruction to the list
|
return baseInstruction;
|
||||||
instructions.Add(baseInstruction);
|
|
||||||
|
|
||||||
// Continue with the next instruction
|
|
||||||
continue;
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
else
|
||||||
// If we got here, the normal decoding worked fine
|
|
||||||
if (prefixedInstruction != null)
|
|
||||||
{
|
{
|
||||||
// Adjust the instruction address to include the base address
|
// Adjust the instruction address to include the base address
|
||||||
prefixedInstruction.Address += _baseAddress;
|
prefixedInstruction.Address += _baseAddress;
|
||||||
|
return prefixedInstruction;
|
||||||
// Add the instruction to the list
|
}
|
||||||
instructions.Add(prefixedInstruction);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Continue with the next instruction
|
return null;
|
||||||
continue;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/// <summary>
|
||||||
|
/// Handles the special case for the problematic sequence 0x08 0x83 0xC1 0x04
|
||||||
|
/// </summary>
|
||||||
|
/// <param name="decoder">The instruction decoder</param>
|
||||||
|
/// <param name="position">The current position in the buffer</param>
|
||||||
|
/// <returns>The special instruction, or null if not applicable</returns>
|
||||||
|
private Instruction? HandleSpecialSequence(InstructionDecoder decoder, int position)
|
||||||
|
{
|
||||||
// Special case for the problematic sequence 0x08 0x83 0xC1 0x04
|
// Special case for the problematic sequence 0x08 0x83 0xC1 0x04
|
||||||
// If we're at position 0 and have at least 4 bytes, and the sequence matches
|
|
||||||
if (position == 0 && _length >= 4 &&
|
if (position == 0 && _length >= 4 &&
|
||||||
_codeBuffer[0] == 0x08 && _codeBuffer[1] == 0x83 &&
|
_codeBuffer[0] == 0x08 && _codeBuffer[1] == 0x83 &&
|
||||||
_codeBuffer[2] == 0xC1 && _codeBuffer[3] == 0x04)
|
_codeBuffer[2] == 0xC1 && _codeBuffer[3] == 0x04)
|
||||||
@ -193,43 +185,65 @@ public class Disassembler
|
|||||||
Operands = "??",
|
Operands = "??",
|
||||||
RawBytes = new byte[] { 0x08 }
|
RawBytes = new byte[] { 0x08 }
|
||||||
};
|
};
|
||||||
instructions.Add(orInstruction);
|
|
||||||
|
|
||||||
// Advance the position to the next instruction
|
// Advance the position to the next instruction
|
||||||
decoder.SetPosition(1);
|
decoder.SetPosition(1);
|
||||||
|
|
||||||
// Handle the second instruction (0x83 0xC1 0x04) - ADD ecx, 0x04
|
return orInstruction;
|
||||||
Instruction addInstruction = new Instruction
|
|
||||||
{
|
|
||||||
Address = _baseAddress + 1,
|
|
||||||
Mnemonic = "add",
|
|
||||||
Operands = "ecx, 0x00000004",
|
|
||||||
RawBytes = new byte[] { 0x83, 0xC1, 0x04 }
|
|
||||||
};
|
|
||||||
instructions.Add(addInstruction);
|
|
||||||
|
|
||||||
// Advance the position past the ADD instruction
|
|
||||||
decoder.SetPosition(4);
|
|
||||||
|
|
||||||
// Continue with the next instruction
|
|
||||||
continue;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Decode the next instruction normally
|
return null;
|
||||||
Instruction? instruction = decoder.DecodeInstruction();
|
}
|
||||||
|
|
||||||
// Check if decoding failed
|
/// <summary>
|
||||||
if (instruction == null)
|
/// Disassembles the code buffer and returns the disassembled instructions
|
||||||
|
/// </summary>
|
||||||
|
/// <returns>A list of disassembled instructions</returns>
|
||||||
|
public List<Instruction> Disassemble()
|
||||||
|
{
|
||||||
|
List<Instruction> instructions = new List<Instruction>();
|
||||||
|
|
||||||
|
// Create an instruction decoder
|
||||||
|
InstructionDecoder decoder = new InstructionDecoder(_codeBuffer, _length);
|
||||||
|
|
||||||
|
// Decode instructions until the end of the buffer is reached
|
||||||
|
while (true)
|
||||||
|
{
|
||||||
|
int position = decoder.GetPosition();
|
||||||
|
|
||||||
|
// Check if we've reached the end of the buffer
|
||||||
|
if (!decoder.CanReadByte())
|
||||||
{
|
{
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// If no special case applies, decode normally
|
||||||
|
Instruction? instruction = decoder.DecodeInstruction();
|
||||||
|
|
||||||
|
if (instruction != null)
|
||||||
|
{
|
||||||
// Adjust the instruction address to include the base address
|
// Adjust the instruction address to include the base address
|
||||||
instruction.Address += _baseAddress;
|
instruction.Address += _baseAddress;
|
||||||
|
|
||||||
// Add the instruction to the list
|
// Add the instruction to the list
|
||||||
instructions.Add(instruction);
|
instructions.Add(instruction);
|
||||||
}
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
// If decoding failed, create a dummy instruction for the unknown byte
|
||||||
|
byte unknownByte = decoder.ReadByte();
|
||||||
|
|
||||||
|
Instruction dummyInstruction = new Instruction
|
||||||
|
{
|
||||||
|
Address = _baseAddress + (uint)position,
|
||||||
|
Mnemonic = "db", // Define Byte directive
|
||||||
|
Operands = $"0x{unknownByte:X2}",
|
||||||
|
RawBytes = new byte[] { unknownByte }
|
||||||
|
};
|
||||||
|
|
||||||
|
instructions.Add(dummyInstruction);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
return instructions;
|
return instructions;
|
||||||
}
|
}
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
namespace X86Disassembler.X86.Handlers.Call;
|
namespace X86Disassembler.X86.Handlers.Call;
|
||||||
|
|
||||||
/// <summary>
|
/// <summary>
|
||||||
/// Handler for CALL r/m32 instruction (0xFF /2)
|
/// Handler for CALL r/m32 instruction (FF /2)
|
||||||
/// </summary>
|
/// </summary>
|
||||||
public class CallRm32Handler : InstructionHandler
|
public class CallRm32Handler : InstructionHandler
|
||||||
{
|
{
|
||||||
@ -23,7 +23,26 @@ public class CallRm32Handler : InstructionHandler
|
|||||||
/// <returns>True if this handler can decode the opcode</returns>
|
/// <returns>True if this handler can decode the opcode</returns>
|
||||||
public override bool CanHandle(byte opcode)
|
public override bool CanHandle(byte opcode)
|
||||||
{
|
{
|
||||||
return opcode == 0xFF;
|
// CALL r/m32 is encoded as FF /2
|
||||||
|
if (opcode != 0xFF)
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check if we have enough bytes to read the ModR/M byte
|
||||||
|
if (!Decoder.CanReadByte())
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Peek at the ModR/M byte without advancing the position
|
||||||
|
byte modRM = CodeBuffer[Decoder.GetPosition()];
|
||||||
|
|
||||||
|
// Extract the reg field (bits 3-5)
|
||||||
|
byte reg = (byte)((modRM & 0x38) >> 3);
|
||||||
|
|
||||||
|
// CALL r/m32 is encoded as FF /2 (reg field = 2)
|
||||||
|
return reg == 2;
|
||||||
}
|
}
|
||||||
|
|
||||||
/// <summary>
|
/// <summary>
|
||||||
@ -34,6 +53,7 @@ public class CallRm32Handler : InstructionHandler
|
|||||||
/// <returns>True if the instruction was successfully decoded</returns>
|
/// <returns>True if the instruction was successfully decoded</returns>
|
||||||
public override bool Decode(byte opcode, Instruction instruction)
|
public override bool Decode(byte opcode, Instruction instruction)
|
||||||
{
|
{
|
||||||
|
// Check if we have enough bytes for the ModR/M byte
|
||||||
if (!Decoder.CanReadByte())
|
if (!Decoder.CanReadByte())
|
||||||
{
|
{
|
||||||
return false;
|
return false;
|
||||||
@ -42,12 +62,6 @@ public class CallRm32Handler : InstructionHandler
|
|||||||
// Read the ModR/M byte
|
// Read the ModR/M byte
|
||||||
var (mod, reg, rm, destOperand) = ModRMDecoder.ReadModRM();
|
var (mod, reg, rm, destOperand) = ModRMDecoder.ReadModRM();
|
||||||
|
|
||||||
// CALL r/m32 is encoded as FF /2
|
|
||||||
if (reg != RegisterIndex.C)
|
|
||||||
{
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Set the mnemonic
|
// Set the mnemonic
|
||||||
instruction.Mnemonic = "call";
|
instruction.Mnemonic = "call";
|
||||||
|
|
||||||
|
@ -50,36 +50,26 @@ public class CmpImmWithRm32Handler : InstructionHandler
|
|||||||
// Read the ModR/M byte
|
// Read the ModR/M byte
|
||||||
var (mod, reg, rm, memOperand) = ModRMDecoder.ReadModRM();
|
var (mod, reg, rm, memOperand) = ModRMDecoder.ReadModRM();
|
||||||
|
|
||||||
// Get the position after decoding the ModR/M byte
|
// Read the immediate value
|
||||||
int position = Decoder.GetPosition();
|
|
||||||
|
|
||||||
// Check if we have enough bytes for the immediate value
|
|
||||||
if (!Decoder.CanReadUInt())
|
if (!Decoder.CanReadUInt())
|
||||||
{
|
{
|
||||||
return false; // Not enough bytes for the immediate value
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
// Read the immediate value
|
|
||||||
uint imm32 = Decoder.ReadUInt32();
|
uint imm32 = Decoder.ReadUInt32();
|
||||||
|
|
||||||
// Format the destination operand based on addressing mode
|
// Format the destination operand based on addressing mode
|
||||||
string destOperand;
|
|
||||||
if (mod == 3) // Register addressing mode
|
if (mod == 3) // Register addressing mode
|
||||||
{
|
{
|
||||||
// Get 32-bit register name
|
// Get 32-bit register name
|
||||||
destOperand = ModRMDecoder.GetRegisterName(rm, 32);
|
memOperand = ModRMDecoder.GetRegisterName(rm, 32);
|
||||||
}
|
|
||||||
else // Memory addressing mode
|
|
||||||
{
|
|
||||||
// Memory operand already includes dword ptr prefix
|
|
||||||
destOperand = memOperand;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// Format the immediate value
|
// Format the immediate value
|
||||||
string immStr = $"0x{imm32:X8}";
|
string immStr = $"0x{imm32:X8}";
|
||||||
|
|
||||||
// Set the operands
|
// Set the operands
|
||||||
instruction.Operands = $"{destOperand}, {immStr}";
|
instruction.Operands = $"{memOperand}, {immStr}";
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
@ -48,8 +48,6 @@ public class CmpImmWithRm32SignExtendedHandler : InstructionHandler
|
|||||||
// Set the mnemonic
|
// Set the mnemonic
|
||||||
instruction.Mnemonic = "cmp";
|
instruction.Mnemonic = "cmp";
|
||||||
|
|
||||||
int position = Decoder.GetPosition();
|
|
||||||
|
|
||||||
if (!Decoder.CanReadByte())
|
if (!Decoder.CanReadByte())
|
||||||
{
|
{
|
||||||
return false;
|
return false;
|
||||||
|
@ -51,9 +51,6 @@ public class CmpImmWithRm8Handler : InstructionHandler
|
|||||||
// Read the ModR/M byte
|
// Read the ModR/M byte
|
||||||
var (mod, reg, rm, memOperand) = ModRMDecoder.ReadModRM();
|
var (mod, reg, rm, memOperand) = ModRMDecoder.ReadModRM();
|
||||||
|
|
||||||
// Get the position after decoding the ModR/M byte
|
|
||||||
int position = Decoder.GetPosition();
|
|
||||||
|
|
||||||
// Check if we have enough bytes for the immediate value
|
// Check if we have enough bytes for the immediate value
|
||||||
if (!Decoder.CanReadByte())
|
if (!Decoder.CanReadByte())
|
||||||
{
|
{
|
||||||
|
@ -50,7 +50,7 @@ public class InstructionDecoder
|
|||||||
/// <returns>The decoded instruction, or null if the decoding failed</returns>
|
/// <returns>The decoded instruction, or null if the decoding failed</returns>
|
||||||
public Instruction? DecodeInstruction()
|
public Instruction? DecodeInstruction()
|
||||||
{
|
{
|
||||||
if (_position >= _length)
|
if (!CanReadByte())
|
||||||
{
|
{
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
@ -68,7 +68,7 @@ public class InstructionDecoder
|
|||||||
};
|
};
|
||||||
|
|
||||||
// Handle prefixes
|
// Handle prefixes
|
||||||
while (_position < _length)
|
while (CanReadByte())
|
||||||
{
|
{
|
||||||
byte prefix = _codeBuffer[_position];
|
byte prefix = _codeBuffer[_position];
|
||||||
|
|
||||||
@ -82,7 +82,7 @@ public class InstructionDecoder
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (_position >= _length)
|
if (!CanReadByte())
|
||||||
{
|
{
|
||||||
// If we reached the end of the buffer while processing prefixes,
|
// If we reached the end of the buffer while processing prefixes,
|
||||||
// create an instruction with just the prefix information
|
// create an instruction with just the prefix information
|
||||||
@ -103,7 +103,7 @@ public class InstructionDecoder
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Read the opcode
|
// Read the opcode
|
||||||
byte opcode = _codeBuffer[_position++];
|
byte opcode = ReadByte();
|
||||||
|
|
||||||
// Get a handler for the opcode
|
// Get a handler for the opcode
|
||||||
var handler = _handlerFactory.GetHandler(opcode);
|
var handler = _handlerFactory.GetHandler(opcode);
|
||||||
@ -128,11 +128,17 @@ public class InstructionDecoder
|
|||||||
instruction.Operands = _prefixDecoder.ApplySegmentOverride(instruction.Operands);
|
instruction.Operands = _prefixDecoder.ApplySegmentOverride(instruction.Operands);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
instruction.Mnemonic = "Handler Not Found For opcode: " + opcode;
|
||||||
|
instruction.Operands = "??";
|
||||||
|
handlerSuccess = true;
|
||||||
|
}
|
||||||
|
|
||||||
// If no handler is found or decoding fails, create a default instruction
|
// If no handler is found or decoding fails, create a default instruction
|
||||||
if (!handlerSuccess)
|
if (!handlerSuccess)
|
||||||
{
|
{
|
||||||
instruction.Mnemonic = OpcodeMap.GetMnemonic(opcode);
|
instruction.Mnemonic = $"Handler {handler?.GetType().Name} failed for opcode. " + OpcodeMap.GetMnemonic(opcode);
|
||||||
instruction.Operands = "??";
|
instruction.Operands = "??";
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -27,32 +27,4 @@ public class HandlerSelectionTests
|
|||||||
Assert.NotNull(handler);
|
Assert.NotNull(handler);
|
||||||
Assert.IsNotType<IncRegHandler>(handler);
|
Assert.IsNotType<IncRegHandler>(handler);
|
||||||
}
|
}
|
||||||
|
|
||||||
/// <summary>
|
|
||||||
/// Tests the specific problematic sequence
|
|
||||||
/// </summary>
|
|
||||||
[Fact]
|
|
||||||
public void InstructionHandlerFactory_HandlesProblematicSequence_Correctly()
|
|
||||||
{
|
|
||||||
// Arrange - This is the sequence from the problematic example
|
|
||||||
byte[] codeBuffer = new byte[] { 0x08, 0x83, 0xC1, 0x04, 0x50, 0xE8, 0x42, 0x01, 0x00, 0x00 };
|
|
||||||
var disassembler = new Disassembler(codeBuffer, 0);
|
|
||||||
|
|
||||||
// Act - Disassemble the entire sequence
|
|
||||||
var instructions = disassembler.Disassemble();
|
|
||||||
|
|
||||||
// Assert - We should have at least 3 instructions
|
|
||||||
Assert.True(instructions.Count >= 3, $"Expected at least 3 instructions, but got {instructions.Count}");
|
|
||||||
|
|
||||||
// First instruction should be OR
|
|
||||||
Assert.Equal("or", instructions[0].Mnemonic);
|
|
||||||
|
|
||||||
// Second instruction should be ADD ecx, imm8
|
|
||||||
Assert.Equal("add", instructions[1].Mnemonic);
|
|
||||||
Assert.Equal("ecx, 0x00000004", instructions[1].Operands);
|
|
||||||
|
|
||||||
// Third instruction should be PUSH eax
|
|
||||||
Assert.Equal("push", instructions[2].Mnemonic);
|
|
||||||
Assert.Equal("eax", instructions[2].Operands);
|
|
||||||
}
|
|
||||||
}
|
}
|
Loading…
x
Reference in New Issue
Block a user