Fixed byte order handling in SUB instruction handlers and updated tests

Implemented SUB r32, r/m32 instruction handlers and tests

Added comprehensive tests for Push/Pop, Xchg, Sub instructions and enhanced segment override tests

X86Disassembler/X86/Handlers/InstructionHandlerFactory.cs

@@ -77,6 +77,7 @@ public class InstructionHandlerFactory
         RegisterFloatingPointHandlers();
         RegisterStringHandlers();
         RegisterMovHandlers();
+        RegisterSubHandlers(); // Register SUB handlers
     }
     
     /// <summary>
@@ -367,6 +368,16 @@ public class InstructionHandlerFactory
         _handlers.Add(new AndEaxImmHandler(_codeBuffer, _decoder, _length));
     }
     
+    /// <summary>
+    /// Registers all SUB instruction handlers
+    /// </summary>
+    private void RegisterSubHandlers()
+    {
+        // Add SUB register/memory handlers
+        _handlers.Add(new Sub.SubRm32R32Handler(_codeBuffer, _decoder, _length));
+        _handlers.Add(new Sub.SubR32Rm32Handler(_codeBuffer, _decoder, _length));
+    }
+    
     /// <summary>
     /// Gets the handler that can decode the given opcode
     /// </summary>

X86Disassembler/X86/Handlers/Sub/SubImmFromRm32Handler.cs

@@ -73,7 +73,16 @@ public class SubImmFromRm32Handler : InstructionHandler
             return false;
         }
         
-        uint imm32 = BitConverter.ToUInt32(CodeBuffer, position);
+        // Read the immediate value in little-endian format and convert to big-endian for display
+        byte b0 = CodeBuffer[position];
+        byte b1 = CodeBuffer[position + 1];
+        byte b2 = CodeBuffer[position + 2];
+        byte b3 = CodeBuffer[position + 3];
+        
+        // Convert from little-endian to big-endian for display
+        uint imm32 = (uint)((b3 << 24) | (b2 << 16) | (b1 << 8) | b0);
+        
+        // Advance the position
         Decoder.SetPosition(position + 4);
         
         // Set the operands

X86Disassembler/X86/Handlers/Sub/SubImmFromRm32SignExtendedHandler.cs

@@ -73,12 +73,26 @@ public class SubImmFromRm32SignExtendedHandler : InstructionHandler
             return false;
         }
         
-        // Read the immediate value as a signed byte and sign-extend it
+        // Read the immediate value as a signed byte and sign-extend it to 32 bits
         sbyte imm8 = (sbyte)CodeBuffer[position++];
+        int imm32 = imm8; // Automatic sign extension from sbyte to int
         Decoder.SetPosition(position);
         
+        // Format the immediate value based on whether it's positive or negative
+        string immStr;
+        if (imm8 < 0)
+        {
+            // For negative values, show the full 32-bit representation
+            immStr = $"0x{(uint)imm32:X8}";
+        }
+        else
+        {
+            // For positive values, just show the value
+            immStr = $"0x{(byte)imm8:X2}";
+        }
+        
         // Set the operands
-        instruction.Operands = $"{destOperand}, 0x{(uint)imm8:X2}";
+        instruction.Operands = $"{destOperand}, {immStr}";
         
         return true;
     }

X86Disassembler/X86/Handlers/Sub/SubR32Rm32Handler.cs

@@ -0,0 +1,73 @@
+namespace X86Disassembler.X86.Handlers.Sub;
+
+/// <summary>
+/// Handler for SUB r32, r/m32 instruction (0x2B)
+/// </summary>
+public class SubR32Rm32Handler : InstructionHandler
+{
+    /// <summary>
+    /// Initializes a new instance of the SubR32Rm32Handler class
+    /// </summary>
+    /// <param name="codeBuffer">The buffer containing the code to decode</param>
+    /// <param name="decoder">The instruction decoder that owns this handler</param>
+    /// <param name="length">The length of the buffer</param>
+    public SubR32Rm32Handler(byte[] codeBuffer, InstructionDecoder decoder, int length)
+        : base(codeBuffer, decoder, length)
+    {
+    }
+
+    /// <summary>
+    /// Checks if this handler can decode the given opcode
+    /// </summary>
+    /// <param name="opcode">The opcode to check</param>
+    /// <returns>True if this handler can decode the opcode</returns>
+    public override bool CanHandle(byte opcode)
+    {
+        return opcode == 0x2B;
+    }
+
+    /// <summary>
+    /// Decodes a SUB r32, r/m32 instruction
+    /// </summary>
+    /// <param name="opcode">The opcode of the instruction</param>
+    /// <param name="instruction">The instruction object to populate</param>
+    /// <returns>True if the instruction was successfully decoded</returns>
+    public override bool Decode(byte opcode, Instruction instruction)
+    {
+        int position = Decoder.GetPosition();
+
+        if (position >= Length)
+        {
+            return false;
+        }
+
+        // Read the ModR/M byte
+        byte modRM = CodeBuffer[position++];
+        Decoder.SetPosition(position);
+
+        // Extract the fields from the ModR/M byte
+        byte mod = (byte)((modRM & 0xC0) >> 6);
+        byte reg = (byte)((modRM & 0x38) >> 3);
+        byte rm = (byte)(modRM & 0x07);
+
+        // Set the mnemonic
+        instruction.Mnemonic = "sub";
+
+        // Get the register name
+        string regName = GetRegister32(reg);
+
+        // For memory operands, set the operand
+        if (mod != 3) // Memory operand
+        {
+            string operand = ModRMDecoder.DecodeModRM(mod, rm, false);
+            instruction.Operands = $"{regName}, {operand}";
+        }
+        else // Register operand
+        {
+            string rmName = GetRegister32(rm);
+            instruction.Operands = $"{regName}, {rmName}";
+        }
+
+        return true;
+    }
+}

X86Disassembler/X86/Handlers/Sub/SubRm32R32Handler.cs

@@ -0,0 +1,73 @@
+namespace X86Disassembler.X86.Handlers.Sub;
+
+/// <summary>
+/// Handler for SUB r/m32, r32 instruction (0x29)
+/// </summary>
+public class SubRm32R32Handler : InstructionHandler
+{
+    /// <summary>
+    /// Initializes a new instance of the SubRm32R32Handler class
+    /// </summary>
+    /// <param name="codeBuffer">The buffer containing the code to decode</param>
+    /// <param name="decoder">The instruction decoder that owns this handler</param>
+    /// <param name="length">The length of the buffer</param>
+    public SubRm32R32Handler(byte[] codeBuffer, InstructionDecoder decoder, int length)
+        : base(codeBuffer, decoder, length)
+    {
+    }
+
+    /// <summary>
+    /// Checks if this handler can decode the given opcode
+    /// </summary>
+    /// <param name="opcode">The opcode to check</param>
+    /// <returns>True if this handler can decode the opcode</returns>
+    public override bool CanHandle(byte opcode)
+    {
+        return opcode == 0x29;
+    }
+
+    /// <summary>
+    /// Decodes a SUB r/m32, r32 instruction
+    /// </summary>
+    /// <param name="opcode">The opcode of the instruction</param>
+    /// <param name="instruction">The instruction object to populate</param>
+    /// <returns>True if the instruction was successfully decoded</returns>
+    public override bool Decode(byte opcode, Instruction instruction)
+    {
+        int position = Decoder.GetPosition();
+
+        if (position >= Length)
+        {
+            return false;
+        }
+
+        // Read the ModR/M byte
+        byte modRM = CodeBuffer[position++];
+        Decoder.SetPosition(position);
+
+        // Extract the fields from the ModR/M byte
+        byte mod = (byte)((modRM & 0xC0) >> 6);
+        byte reg = (byte)((modRM & 0x38) >> 3);
+        byte rm = (byte)(modRM & 0x07);
+
+        // Set the mnemonic
+        instruction.Mnemonic = "sub";
+
+        // Get the register name
+        string regName = GetRegister32(reg);
+
+        // For memory operands, set the operand
+        if (mod != 3) // Memory operand
+        {
+            string operand = ModRMDecoder.DecodeModRM(mod, rm, false);
+            instruction.Operands = $"{operand}, {regName}";
+        }
+        else // Register operand
+        {
+            string rmName = GetRegister32(rm);
+            instruction.Operands = $"{rmName}, {regName}";
+        }
+
+        return true;
+    }
+}