Fixed immediate value formatting in Group1 instruction handlers

X86DisassemblerTests/GeneralDisassemblerInstructionTests.cs

@@ -0,0 +1,101 @@
+using System.Reflection;
+using System.Text.Json;
+using Xunit;
+using X86Disassembler.X86;
+
+namespace X86DisassemblerTests;
+
+/// <summary>
+/// General tests for the X86 disassembler using a JSON test file
+/// </summary>
+public class GeneralDisassemblerInstructionTests
+{
+    /// <summary>
+    /// Runs tests on all instructions defined in the JSON file
+    /// </summary>
+    [Fact]
+    public void RunTestsOnJson()
+    {
+        // Load the JSON test file from embedded resources
+        using var jsonStream = Assembly.GetExecutingAssembly()
+            .GetManifestResourceStream("X86DisassemblerTests.instruction_test.json");
+
+        if (jsonStream == null)
+        {
+            throw new InvalidOperationException("Could not find instruction_test.json embedded resource");
+        }
+
+        // Deserialize the JSON file
+        var instructions = JsonSerializer.Deserialize<List<JsonInstructionEntry>>(jsonStream)!;
+
+        // Run tests for each instruction
+        for (var index = 0; index < instructions.Count; index++)
+        {
+            var test = instructions[index];
+            // Convert hex string to byte array
+            byte[] code = HexStringToByteArray(test.RawBytes);
+
+            // Create a disassembler with the code
+            Disassembler disassembler = new Disassembler(code, 0x1000);
+
+            // Disassemble the code
+            var disassembledInstructions = disassembler.Disassemble();
+
+            // Verify the number of instructions
+            if (test.Disassembled.Count != disassembledInstructions.Count)
+            {
+                Assert.Fail(
+                    $"Failed verifying test {index}: {test.RawBytes}. Instruction count mismatch.\n" +
+                    $"Expected \"{test.Disassembled.Count}\", but got \"{disassembledInstructions.Count}\".\n" +
+                    $"Disassembled instructions:\n" +
+                    $"{string.Join("\n", disassembledInstructions)}"
+                );
+            }
+
+            // Verify each instruction
+            for (int i = 0; i < test.Disassembled.Count; i++)
+            {
+                var expected = test.Disassembled[i];
+                var actual = disassembledInstructions[i];
+
+                if (expected.Mnemonic != actual.Mnemonic)
+                {
+                    Assert.Fail(
+                        $"Failed verifying test {index}: {test.RawBytes}. Instruction {i}. Mnemonic mismatch. " +
+                        $"Expected \"{expected.Mnemonic}\", but got {actual.Mnemonic}\""
+                    );
+                }
+                if (expected.Operands != actual.Operands)
+                {
+                    Assert.Fail(
+                        $"Failed verifying test {index}: {test.RawBytes}. Instruction {i}. Operands mismatch. " +
+                        $"Expected \"{expected.Operands}\", but got \"{actual.Operands}\""
+                    );
+                }
+            }
+        }
+    }
+
+    /// <summary>
+    /// Converts a hex string to a byte array
+    /// </summary>
+    /// <param name="hex">The hex string to convert</param>
+    /// <returns>The byte array</returns>
+    private static byte[] HexStringToByteArray(string hex)
+    {
+        // Remove any non-hex characters
+        hex = hex.Replace(" ", "")
+            .Replace("-", "");
+
+        // Create a byte array
+        byte[] bytes = new byte[hex.Length / 2];
+
+        // Convert each pair of hex characters to a byte
+        for (int i = 0; i < hex.Length; i += 2)
+        {
+            bytes[i / 2] = Convert.ToByte(hex.Substring(i, 2), 16);
+        }
+
+        return bytes;
+    }
+}

X86DisassemblerTests/InstructionTests/AdcInstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for ADC (Add with Carry) instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/AddEaxImmHandlerTests.cs

@@ -1,9 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers.Add;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for ADD EAX, imm32 instruction handler

X86DisassemblerTests/InstructionTests/AddInstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for ADD instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/AddRm32R32Tests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for ADD r/m32, r32 instruction (0x01)
 /// </summary>

X86DisassemblerTests/InstructionTests/AndInstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for AND instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/ArithmeticUnaryTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for arithmetic unary operations (DIV, IDIV, MUL, IMUL, NEG, NOT)
 /// </summary>

X86DisassemblerTests/InstructionTests/CallInstructionTests.cs

@@ -1,9 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for call instruction handlers

X86DisassemblerTests/InstructionTests/CallRm32Tests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for CALL r/m32 instruction (0xFF /2)
 /// </summary>

X86DisassemblerTests/InstructionTests/CmpImmWithRm8Tests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for CMP r/m8, imm8 instruction (0x80 /7)
 /// </summary>

X86DisassemblerTests/InstructionTests/CmpInstructionHandlerTests.cs

@@ -1,10 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers;
-using X86Disassembler.X86.Handlers.Cmp;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for CMP instruction handlers

X86DisassemblerTests/InstructionTests/CmpInstructionSequenceTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for CMP instruction sequences
 /// </summary>
@@ -100,5 +98,9 @@ public class CmpInstructionSequenceTests
         // Fifth instruction: ADD EBP, -0x48 (0xB8 sign-extended to 32-bit is 0xFFFFFFB8)
         Assert.Equal("add", instructions[4].Mnemonic);
         Assert.Equal("ebp, 0xFFFFFFB8", instructions[4].Operands);
+        
+        // Sixth instruction: MOV EDX, DWORD PTR [ESI+0x4]
+        Assert.Equal("mov", instructions[5].Mnemonic);
+        Assert.Equal("edx, dword ptr [esi+0x04]", instructions[5].Operands);
     }
 }

X86DisassemblerTests/InstructionTests/CmpInstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for CMP instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/DataTransferInstructionTests.cs

@@ -1,9 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for data transfer instruction handlers

X86DisassemblerTests/InstructionTests/DebugHandlerRegistration.cs

@@ -2,10 +2,9 @@ using System.Reflection;
 using System.Text;
 using X86Disassembler.X86;
 using X86Disassembler.X86.Handlers;
-using Xunit;
 using Xunit.Abstractions;
 
-namespace X86DisassemblerTests;
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Debug test to find missing handler registrations

X86DisassemblerTests/InstructionTests/DecInstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for DEC instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/FloatingPointInstructionTests.cs

@@ -1,10 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers;
-using X86Disassembler.X86.Handlers.FloatingPoint;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for floating-point instruction handlers

X86DisassemblerTests/InstructionTests/Group1InstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for Group1 instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/Group1SignExtendedHandlerTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for Group 1 sign-extended immediate instructions (0x83 opcode)
 /// </summary>

X86DisassemblerTests/InstructionTests/Group3InstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for Group3 instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/HandlerSelectionTests.cs

@@ -1,11 +1,9 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 using X86Disassembler.X86.Handlers;
 using X86Disassembler.X86.Handlers.Inc;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for handler selection in the InstructionHandlerFactory
 /// </summary>

X86DisassemblerTests/InstructionTests/IncInstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for INC instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/InstructionDecoderTests.cs

@@ -1,10 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using System.Diagnostics;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for the InstructionDecoder class
 /// </summary>

X86DisassemblerTests/InstructionTests/InstructionHandlerFactoryTests.cs

@@ -2,7 +2,7 @@
 using X86Disassembler.X86;
 using X86Disassembler.X86.Handlers;
 
-namespace X86DisassemblerTests;
+namespace X86DisassemblerTests.InstructionTests;
 
 public class InstructionHandlerFactoryTests
 {

X86DisassemblerTests/InstructionTests/InstructionSequenceTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for specific instruction sequences that were problematic
 /// </summary>

X86DisassemblerTests/InstructionTests/Int3InstructionTests.cs

@@ -1,8 +1,7 @@
-namespace X86DisassemblerTests;
-
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for INT3 instruction handler
 /// </summary>

X86DisassemblerTests/InstructionTests/JumpInstructionTests.cs

@@ -1,9 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers.Jump;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for jump instruction handlers

X86DisassemblerTests/InstructionTests/LeaInstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for LEA instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/MovRm32Imm32Tests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for MOV r/m32, imm32 instruction (0xC7)
 /// </summary>

X86DisassemblerTests/InstructionTests/MovRm8Imm8Tests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for MOV r/m8, imm8 instruction (0xC6)
 /// </summary>

X86DisassemblerTests/InstructionTests/OrInstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for OR instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/OrRm8R8HandlerTests.cs

@@ -1,9 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers.Or;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for OR r/m8, r8 instruction handler

X86DisassemblerTests/InstructionTests/PushPopInstructionTests.cs

@@ -1,10 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers.Push;
-using X86Disassembler.X86.Handlers.Pop;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for push and pop instruction handlers

X86DisassemblerTests/InstructionTests/ReturnInstructionTests.cs

@@ -1,9 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for return instruction handlers

X86DisassemblerTests/InstructionTests/SbbInstructionTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for SBB (Subtract with Borrow) instruction handlers
 /// </summary>

X86DisassemblerTests/InstructionTests/SegmentOverrideTests.cs

@@ -1,9 +1,7 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
 
+namespace X86DisassemblerTests.InstructionTests;
+
 /// <summary>
 /// Tests for segment override prefixes
 /// </summary>

X86DisassemblerTests/InstructionTests/StringInstructionHandlerTests.cs

@@ -1,9 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers.String;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for string instruction handlers

X86DisassemblerTests/InstructionTests/SubInstructionTests.cs

@@ -0,0 +1,224 @@
+using X86Disassembler.X86;
+
+namespace X86DisassemblerTests.InstructionTests;
+
+/// <summary>
+/// Tests for SUB instruction handlers
+/// </summary>
+public class SubInstructionTests
+{
+    /// <summary>
+    /// Tests the SubImmFromRm32Handler for decoding SUB r/m32, imm32 instruction
+    /// </summary>
+    [Fact]
+    public void SubImmFromRm32Handler_DecodesSubRm32Imm32_Correctly()
+    {
+        // Arrange
+        // SUB EAX, 0x12345678 (81 E8 78 56 34 12) - Subtract 0x12345678 from EAX
+        byte[] codeBuffer = new byte[] { 0x81, 0xE8, 0x78, 0x56, 0x34, 0x12 };
+        var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length);
+        
+        // Act
+        var instruction = decoder.DecodeInstruction();
+        
+        // Assert
+        Assert.NotNull(instruction);
+        Assert.Equal("sub", instruction.Mnemonic);
+        Assert.Equal("eax, 0x12345678", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests the SubImmFromRm32Handler for decoding SUB memory, imm32 instruction
+    /// </summary>
+    [Fact]
+    public void SubImmFromRm32Handler_DecodesSubMemImm32_Correctly()
+    {
+        // Arrange
+        // SUB [EBX+0x10], 0x12345678 (81 6B 10 78 56 34 12) - Subtract 0x12345678 from memory at [EBX+0x10]
+        byte[] codeBuffer = new byte[] { 0x81, 0x6B, 0x10, 0x78, 0x56, 0x34, 0x12 };
+        var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length);
+        
+        // Act
+        var instruction = decoder.DecodeInstruction();
+        
+        // Assert
+        Assert.NotNull(instruction);
+        Assert.Equal("sub", instruction.Mnemonic);
+        // The actual output from the disassembler for this instruction
+        Assert.Equal("dword ptr [ebx+0x10], 0x12345678", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests the SubImmFromRm32SignExtendedHandler for decoding SUB r/m32, imm8 instruction (sign-extended)
+    /// </summary>
+    [Fact]
+    public void SubImmFromRm32SignExtendedHandler_DecodesSubRm32Imm8_Correctly()
+    {
+        // Arrange
+        // SUB EAX, 0x42 (83 E8 42) - Subtract sign-extended 0x42 from EAX
+        byte[] codeBuffer = new byte[] { 0x83, 0xE8, 0x42 };
+        var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length);
+        
+        // Act
+        var instruction = decoder.DecodeInstruction();
+        
+        // Assert
+        Assert.NotNull(instruction);
+        Assert.Equal("sub", instruction.Mnemonic);
+        Assert.Equal("eax, 0x42", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests the SubImmFromRm32SignExtendedHandler for decoding SUB r/m32, negative imm8 instruction (sign-extended)
+    /// </summary>
+    [Fact]
+    public void SubImmFromRm32SignExtendedHandler_DecodesSubRm32NegativeImm8_Correctly()
+    {
+        // Arrange
+        // SUB EAX, 0xF0 (83 E8 F0) - Subtract sign-extended 0xF0 from EAX
+        byte[] codeBuffer = new byte[] { 0x83, 0xE8, 0xF0 };
+        var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length);
+        
+        // Act
+        var instruction = decoder.DecodeInstruction();
+        
+        // Assert
+        Assert.NotNull(instruction);
+        Assert.Equal("sub", instruction.Mnemonic);
+        // F0 is -16 in two's complement, should be sign-extended to 0xFFFFFFF0
+        Assert.Equal("eax, 0xFFFFFFF0", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests the SubImmFromRm32SignExtendedHandler for decoding SUB memory, imm8 instruction
+    /// </summary>
+    [Fact]
+    public void SubImmFromRm32SignExtendedHandler_DecodesSubMemImm8_Correctly()
+    {
+        // Arrange
+        // SUB [EBX+0x10], 0x42 (83 6B 10 42) - Subtract sign-extended 0x42 from memory at [EBX+0x10]
+        byte[] codeBuffer = new byte[] { 0x83, 0x6B, 0x10, 0x42 };
+        var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length);
+        
+        // Act
+        var instruction = decoder.DecodeInstruction();
+        
+        // Assert
+        Assert.NotNull(instruction);
+        Assert.Equal("sub", instruction.Mnemonic);
+        // The actual output from the disassembler for this instruction
+        Assert.Equal("dword ptr [ebx+0x10], 0x42", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests the SubR32Rm32Handler for decoding SUB r32, r/m32 instruction
+    /// </summary>
+    [Fact]
+    public void SubR32Rm32Handler_DecodesSubR32Rm32_Correctly()
+    {
+        // Arrange
+        // SUB EBX, EAX (2B D8) - Subtract EAX from EBX
+        byte[] codeBuffer = new byte[] { 0x2B, 0xD8 };
+        var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length);
+        
+        // Act
+        var instruction = decoder.DecodeInstruction();
+        
+        // Assert
+        Assert.NotNull(instruction);
+        Assert.Equal("sub", instruction.Mnemonic);
+        Assert.Equal("ebx, eax", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests the SubRm32R32Handler for decoding SUB r/m32, r32 instruction
+    /// </summary>
+    [Fact]
+    public void SubRm32R32Handler_DecodesSubRm32R32_Correctly()
+    {
+        // Arrange
+        // SUB EAX, EBX (29 D8) - Subtract EBX from EAX
+        byte[] codeBuffer = new byte[] { 0x29, 0xD8 };
+        var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length);
+        
+        // Act
+        var instruction = decoder.DecodeInstruction();
+        
+        // Assert
+        Assert.NotNull(instruction);
+        Assert.Equal("sub", instruction.Mnemonic);
+        Assert.Equal("eax, ebx", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests the SubRm32R32Handler for decoding SUB memory, r32 instruction
+    /// </summary>
+    [Fact]
+    public void SubRm32R32Handler_DecodesSubMemR32_Correctly()
+    {
+        // Arrange
+        // SUB [EBX+0x10], ECX (29 4B 10) - Subtract ECX from memory at [EBX+0x10]
+        byte[] codeBuffer = new byte[] { 0x29, 0x4B, 0x10 };
+        var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length);
+        
+        // Act
+        var instruction = decoder.DecodeInstruction();
+        
+        // Assert
+        Assert.NotNull(instruction);
+        Assert.Equal("sub", instruction.Mnemonic);
+        Assert.Equal("dword ptr [ebx+0x10], ecx", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests the SubR32Rm32Handler for decoding SUB r32, memory instruction
+    /// </summary>
+    [Fact]
+    public void SubR32Rm32Handler_DecodesSubR32Mem_Correctly()
+    {
+        // Arrange
+        // SUB ECX, [EBX+0x10] (2B 4B 10) - Subtract memory at [EBX+0x10] from ECX
+        byte[] codeBuffer = new byte[] { 0x2B, 0x4B, 0x10 };
+        var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length);
+        
+        // Act
+        var instruction = decoder.DecodeInstruction();
+        
+        // Assert
+        Assert.NotNull(instruction);
+        Assert.Equal("sub", instruction.Mnemonic);
+        Assert.Equal("ecx, dword ptr [ebx+0x10]", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests a sequence of SUB instructions with different encoding
+    /// </summary>
+    [Fact]
+    public void SubInstruction_DecodesComplexSubSequence_Correctly()
+    {
+        // Arrange
+        // SUB ESP, 0x10 (83 EC 10) - Create stack space
+        // SUB EAX, EBX (29 D8) - Subtract EBX from EAX
+        // SUB ECX, [EBP-4] (2B 4D FC) - Subtract memory at [EBP-4] from ECX
+        byte[] codeBuffer = new byte[] { 0x83, 0xEC, 0x10, 0x29, 0xD8, 0x2B, 0x4D, 0xFC };
+        var disassembler = new Disassembler(codeBuffer, 0);
+        
+        // Act
+        var instructions = disassembler.Disassemble();
+        
+        // Assert
+        Assert.Equal(3, instructions.Count);
+        
+        // First instruction: SUB ESP, 0x10
+        Assert.Equal("sub", instructions[0].Mnemonic);
+        Assert.Equal("esp, 0x10", instructions[0].Operands);
+        
+        // Second instruction: SUB EAX, EBX
+        Assert.Equal("sub", instructions[1].Mnemonic);
+        Assert.Equal("eax, ebx", instructions[1].Operands);
+        
+        // Third instruction: SUB ECX, [EBP-4]
+        Assert.Equal("sub", instructions[2].Mnemonic);
+        Assert.Equal("ecx, dword ptr [ebp-0x04]", instructions[2].Operands);
+    }
+}

X86DisassemblerTests/InstructionTests/TestInstructionHandlerTests.cs

@@ -1,11 +1,6 @@
-using X86Disassembler.X86.Handlers.Test;
-
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for TEST instruction handlers

X86DisassemblerTests/InstructionTests/XchgInstructionTests.cs

@@ -1,9 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers.Xchg;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for exchange instruction handlers

X86DisassemblerTests/InstructionTests/XorInstructionTests.cs

@@ -1,9 +1,6 @@
-namespace X86DisassemblerTests;
-
-using System;
-using Xunit;
 using X86Disassembler.X86;
-using X86Disassembler.X86.Handlers;
+
+namespace X86DisassemblerTests.InstructionTests;
 
 /// <summary>
 /// Tests for XOR instruction handlers

X86DisassemblerTests/JsonInstructionEntry.cs

@@ -0,0 +1,13 @@
+namespace X86DisassemblerTests;
+
+public class JsonInstructionEntry
+{
+    public string RawBytes { get; set; } = "";
+    public List<JsonDisassembledInstruction> Disassembled { get; set; } = [];
+}
+
+public class JsonDisassembledInstruction
+{
+    public string Mnemonic { get; set; } = "";
+    public string Operands { get; set; } = "";
+}

X86DisassemblerTests/SubInstructionTests.cs

@@ -48,7 +48,7 @@ public class SubInstructionTests
         Assert.NotNull(instruction);
         Assert.Equal("sub", instruction.Mnemonic);
         // The actual output from the disassembler for this instruction
-        Assert.Equal("dword ptr [ebx+0x10], 0x34567810", instruction.Operands);
+        Assert.Equal("dword ptr [ebx+0x10], 0x12345678", instruction.Operands);
     }
     
     /// <summary>
@@ -110,7 +110,29 @@ public class SubInstructionTests
         Assert.NotNull(instruction);
         Assert.Equal("sub", instruction.Mnemonic);
         // The actual output from the disassembler for this instruction
-        Assert.Equal("dword ptr [ebx+0x10], 0x10", instruction.Operands);
+        Assert.Equal("dword ptr [ebx+0x10], 0x42", instruction.Operands);
+    }
+    
+    /// <summary>
+    /// Tests a sequence of SUB instructions in a common pattern
+    /// </summary>
+    [Fact]
+    public void SubInstruction_DecodesSubSequence_Correctly()
+    {
+        // Arrange
+        // SUB ESP, 0x10 (83 EC 10) - Create stack space
+        byte[] codeBuffer = new byte[] { 0x83, 0xEC, 0x10 };
+        var disassembler = new Disassembler(codeBuffer, 0);
+        
+        // Act
+        var instructions = disassembler.Disassemble();
+        
+        // Assert
+        Assert.Single(instructions);
+        
+        // Instruction: SUB ESP, 0x10
+        Assert.Equal("sub", instructions[0].Mnemonic);
+        Assert.Equal("esp, 0x10", instructions[0].Operands);
     }
     
     /// <summary>

X86DisassemblerTests/UnitTest1.cs

@@ -1,10 +0,0 @@
-namespace X86DisassemblerTests;
-
-public class UnitTest1
-{
-    [Fact]
-    public void Test1()
-    {
-
-    }
-}

X86DisassemblerTests/X86DisassemblerTests.csproj

@@ -26,4 +26,9 @@
     <ProjectReference Include="..\X86Disassembler\X86Disassembler.csproj" />
   </ItemGroup>
 
+  <ItemGroup>
+    <None Remove="instruction_test.json" />
+    <EmbeddedResource Include="instruction_test.json" />
+  </ItemGroup>
+
 </Project>

X86DisassemblerTests/instruction_test.json

@@ -0,0 +1,397 @@
+[
+  {
+    "RawBytes": "50",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "eax"
+      }
+    ]
+  },
+  {
+    "RawBytes": "51",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "ecx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "52",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "edx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "53",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "ebx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "54",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "esp"
+      }
+    ]
+  },
+  {
+    "RawBytes": "55",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "ebp"
+      }
+    ]
+  },
+  {
+    "RawBytes": "56",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "esi"
+      }
+    ]
+  },
+  {
+    "RawBytes": "57",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "edi"
+      }
+    ]
+  },
+  {
+    "RawBytes": "58",
+    "Disassembled": [
+      {
+        "Mnemonic": "pop",
+        "Operands": "eax"
+      }
+    ]
+  },
+  {
+    "RawBytes": "59",
+    "Disassembled": [
+      {
+        "Mnemonic": "pop",
+        "Operands": "ecx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "5A",
+    "Disassembled": [
+      {
+        "Mnemonic": "pop",
+        "Operands": "edx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "5B",
+    "Disassembled": [
+      {
+        "Mnemonic": "pop",
+        "Operands": "ebx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "5C",
+    "Disassembled": [
+      {
+        "Mnemonic": "pop",
+        "Operands": "esp"
+      }
+    ]
+  },
+  {
+    "RawBytes": "5D",
+    "Disassembled": [
+      {
+        "Mnemonic": "pop",
+        "Operands": "ebp"
+      }
+    ]
+  },
+  {
+    "RawBytes": "5E",
+    "Disassembled": [
+      {
+        "Mnemonic": "pop",
+        "Operands": "esi"
+      }
+    ]
+  },
+  {
+    "RawBytes": "5F",
+    "Disassembled": [
+      {
+        "Mnemonic": "pop",
+        "Operands": "edi"
+      }
+    ]
+  },
+  {
+    "RawBytes": "6810000000",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "0x00000010"
+      }
+    ]
+  },
+  {
+    "RawBytes": "6A10",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "0x10"
+      }
+    ]
+  },
+  {
+    "RawBytes": "90",
+    "Disassembled": [
+      {
+        "Mnemonic": "nop",
+        "Operands": ""
+      }
+    ]
+  },
+  {
+    "RawBytes": "91",
+    "Disassembled": [
+      {
+        "Mnemonic": "xchg",
+        "Operands": "eax, ecx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "92",
+    "Disassembled": [
+      {
+        "Mnemonic": "xchg",
+        "Operands": "eax, edx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "93",
+    "Disassembled": [
+      {
+        "Mnemonic": "xchg",
+        "Operands": "eax, ebx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "94",
+    "Disassembled": [
+      {
+        "Mnemonic": "xchg",
+        "Operands": "eax, esp"
+      }
+    ]
+  },
+  {
+    "RawBytes": "95",
+    "Disassembled": [
+      {
+        "Mnemonic": "xchg",
+        "Operands": "eax, ebp"
+      }
+    ]
+  },
+  {
+    "RawBytes": "96",
+    "Disassembled": [
+      {
+        "Mnemonic": "xchg",
+        "Operands": "eax, esi"
+      }
+    ]
+  },
+  {
+    "RawBytes": "97",
+    "Disassembled": [
+      {
+        "Mnemonic": "xchg",
+        "Operands": "eax, edi"
+      }
+    ]
+  },
+  {
+    "RawBytes": "29D8",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "eax, ebx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "294B10",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "dword ptr [ebx+0x10], ecx"
+      }
+    ]
+  },
+  {
+    "RawBytes": "2BD8",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "ebx, eax"
+      }
+    ]
+  },
+  {
+    "RawBytes": "2B4B10",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "ecx, dword ptr [ebx+0x10]"
+      }
+    ]
+  },
+  {
+    "RawBytes": "81E878563412",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "eax, 0x12345678"
+      }
+    ]
+  },
+  {
+    "RawBytes": "816B1078563412",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "dword ptr [ebx+0x10], 0x12345678"
+      }
+    ]
+  },
+  {
+    "RawBytes": "83E842",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "eax, 0x42"
+      }
+    ]
+  },
+  {
+    "RawBytes": "83E8F0",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "eax, 0xFFFFFFF0"
+      }
+    ]
+  },
+  {
+    "RawBytes": "836B1042",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "dword ptr [ebx+0x10], 0x42"
+      }
+    ]
+  },
+  {
+    "RawBytes": "83EC10",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "esp, 0x10"
+      }
+    ]
+  },
+  {
+    "RawBytes": "83EC1029D82B4DFC",
+    "Disassembled": [
+      {
+        "Mnemonic": "sub",
+        "Operands": "esp, 0x10"
+      },
+      {
+        "Mnemonic": "sub",
+        "Operands": "eax, ebx"
+      },
+      {
+        "Mnemonic": "sub",
+        "Operands": "ecx, dword ptr [ebp-0x04]"
+      }
+    ]
+  },
+  {
+    "RawBytes": "26FF7510",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "dword ptr es:[ebp+0x10]"
+      }
+    ]
+  },
+  {
+    "RawBytes": "2EFF7510",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "dword ptr cs:[ebp+0x10]"
+      }
+    ]
+  },
+  {
+    "RawBytes": "36FF7510",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "dword ptr ss:[ebp+0x10]"
+      }
+    ]
+  },
+  {
+    "RawBytes": "3EFF7510",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "dword ptr ds:[ebp+0x10]"
+      }
+    ]
+  },
+  {
+    "RawBytes": "64FF7510",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "dword ptr fs:[ebp+0x10]"
+      }
+    ]
+  },
+  {
+    "RawBytes": "65FF7510",
+    "Disassembled": [
+      {
+        "Mnemonic": "push",
+        "Operands": "dword ptr gs:[ebp+0x10]"
+      }
+    ]
+  }
+]