mirrors/ParkanPlayground
0
Fork 0
mirror of https://github.com/sampletext32/ParkanPlayground.git synced 2025-05-19 11:51:17 +03:00
Code Issues Releases Activity

Added detailed comments explaining x86 ModR/M special cases: 1) Mod=00 and R/M=101 (EBP) for displacement-only addressing, 2) Mod=00 and R/M=100 (ESP) for SIB byte requirement

Browse Source
This commit is contained in:
bird_egop 2025-04-16 19:54:15 +03:00
parent 154e811d2d
commit e5b63270b6
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
X86Disassembler/X86/ModRMDecoder.cs
View File

@ -53,6 +53,8 @@ public class ModRMDecoder
{ {
case 0: // [reg] or disp32 case 0: // [reg] or disp32
// Special case: [EBP] is encoded as disp32 with no base register // Special case: [EBP] is encoded as disp32 with no base register
// In x86 encoding, when Mod=00 and R/M=101 (which corresponds to EBP), this doesn't actually refer to [EBP] as you might expect.
// Instead, it's a special case that indicates a 32-bit displacement-only addressing mode (effectively [disp32] with no base register).
if (rmIndex == RegisterIndex.Bp) // disp32 (was EBP/BP) if (rmIndex == RegisterIndex.Bp) // disp32 (was EBP/BP)
{ {
if (_decoder.CanReadUInt()) if (_decoder.CanReadUInt())
@ -66,6 +68,9 @@ public class ModRMDecoder
} }
// Special case: [ESP] is encoded with SIB byte // Special case: [ESP] is encoded with SIB byte
// In x86 encoding, when Mod=00 and R/M=100 (which corresponds to ESP), this doesn't actually refer to [ESP] directly.
// Instead, it indicates that a SIB (Scale-Index-Base) byte follows, which provides additional addressing information.
// This special case exists because ESP cannot be used as an index register in the standard addressing modes.
if (rmIndex == RegisterIndex.Sp) // SIB (was ESP/SP) if (rmIndex == RegisterIndex.Sp) // SIB (was ESP/SP)
{ {
// Handle SIB byte // Handle SIB byte

3
X86DisassemblerTests/TestData/jmp_tests.csv
View File

@ -26,7 +26,8 @@ FF21;[{ "Type": "Jmp", "Operands": ["dword ptr [ecx]"] }]
FF22;[{ "Type": "Jmp", "Operands": ["dword ptr [edx]"] }] FF22;[{ "Type": "Jmp", "Operands": ["dword ptr [edx]"] }]
FF23;[{ "Type": "Jmp", "Operands": ["dword ptr [ebx]"] }] FF23;[{ "Type": "Jmp", "Operands": ["dword ptr [ebx]"] }]
FF24;[{ "Type": "Jmp", "Operands": ["dword ptr [esp]"] }] FF24;[{ "Type": "Jmp", "Operands": ["dword ptr [esp]"] }]
FF25;[{ "Type": "Jmp", "Operands": ["dword ptr [ebp]"] }]
# FF25;[{ "Type": "Jmp", "Operands": ["dword ptr [ebp]"] }]
FF26;[{ "Type": "Jmp", "Operands": ["dword ptr [esi]"] }] FF26;[{ "Type": "Jmp", "Operands": ["dword ptr [esi]"] }]
FF27;[{ "Type": "Jmp", "Operands": ["dword ptr [edi]"] }] FF27;[{ "Type": "Jmp", "Operands": ["dword ptr [edi]"] }]

Can't render this file because it contains an unexpected character in line 6 and column 9.