diff --git a/X86Disassembler/X86/Handlers/ArithmeticImmediate/AndImmWithRm32Handler.cs b/X86Disassembler/X86/Handlers/ArithmeticImmediate/AndImmWithRm32Handler.cs deleted file mode 100644 index 1497e66..0000000 --- a/X86Disassembler/X86/Handlers/ArithmeticImmediate/AndImmWithRm32Handler.cs +++ /dev/null @@ -1,84 +0,0 @@ -namespace X86Disassembler.X86.Handlers.ArithmeticImmediate; - -/// -/// Handler for AND r/m32, imm32 instruction (0x81 /4) -/// -public class AndImmWithRm32Handler : InstructionHandler -{ - /// - /// Initializes a new instance of the AndImmWithRm32Handler class - /// - /// The buffer containing the code to decode - /// The instruction decoder that owns this handler - /// The length of the buffer - public AndImmWithRm32Handler(byte[] codeBuffer, InstructionDecoder decoder, int length) - : base(codeBuffer, decoder, length) - { - } - - /// - /// Checks if this handler can decode the given opcode - /// - /// The opcode to check - /// True if this handler can decode the opcode - public override bool CanHandle(byte opcode) - { - if (opcode != 0x81) - return false; - - // Check if the reg field of the ModR/M byte is 4 (AND) - int position = Decoder.GetPosition(); - if (position >= Length) - return false; - - byte modRM = CodeBuffer[position]; - byte reg = (byte)((modRM & 0x38) >> 3); - - return reg == 4; // 4 = AND - } - - /// - /// Decodes an AND r/m32, imm32 instruction - /// - /// The opcode of the instruction - /// The instruction object to populate - /// True if the instruction was successfully decoded - public override bool Decode(byte opcode, Instruction instruction) - { - // Set the mnemonic - instruction.Mnemonic = "and"; - - int position = Decoder.GetPosition(); - - if (position >= Length) - { - return false; - } - - // Read the ModR/M byte - byte modRM = CodeBuffer[position++]; - Decoder.SetPosition(position); - - // Extract the fields from the ModR/M byte - byte mod = (byte)((modRM & 0xC0) >> 6); - byte reg = (byte)((modRM & 0x38) >> 3); // Should be 4 for AND - byte rm = (byte)(modRM & 0x07); - - // Decode the destination operand - string destOperand = ModRMDecoder.DecodeModRM(mod, rm, false); - - // Read the immediate value - if (position + 3 >= Length) - { - return false; - } - - uint imm32 = BitConverter.ToUInt32(CodeBuffer, position); - Decoder.SetPosition(position + 4); - - // Set the operands - instruction.Operands = $"{destOperand}, 0x{imm32:X8}"; - - return true; - } -} diff --git a/X86Disassembler/X86/Handlers/ArithmeticImmediate/AndImmWithRm32SignExtendedHandler.cs b/X86Disassembler/X86/Handlers/ArithmeticImmediate/AndImmWithRm32SignExtendedHandler.cs deleted file mode 100644 index 574e848..0000000 --- a/X86Disassembler/X86/Handlers/ArithmeticImmediate/AndImmWithRm32SignExtendedHandler.cs +++ /dev/null @@ -1,85 +0,0 @@ -namespace X86Disassembler.X86.Handlers.ArithmeticImmediate; - -/// -/// Handler for AND r/m32, imm8 (sign-extended) instruction (0x83 /4) -/// -public class AndImmWithRm32SignExtendedHandler : InstructionHandler -{ - /// - /// Initializes a new instance of the AndImmWithRm32SignExtendedHandler class - /// - /// The buffer containing the code to decode - /// The instruction decoder that owns this handler - /// The length of the buffer - public AndImmWithRm32SignExtendedHandler(byte[] codeBuffer, InstructionDecoder decoder, int length) - : base(codeBuffer, decoder, length) - { - } - - /// - /// Checks if this handler can decode the given opcode - /// - /// The opcode to check - /// True if this handler can decode the opcode - public override bool CanHandle(byte opcode) - { - if (opcode != 0x83) - return false; - - // Check if the reg field of the ModR/M byte is 4 (AND) - int position = Decoder.GetPosition(); - if (position >= Length) - return false; - - byte modRM = CodeBuffer[position]; - byte reg = (byte)((modRM & 0x38) >> 3); - - return reg == 4; // 4 = AND - } - - /// - /// Decodes an AND r/m32, imm8 (sign-extended) instruction - /// - /// The opcode of the instruction - /// The instruction object to populate - /// True if the instruction was successfully decoded - public override bool Decode(byte opcode, Instruction instruction) - { - // Set the mnemonic - instruction.Mnemonic = "and"; - - int position = Decoder.GetPosition(); - - if (position >= Length) - { - return false; - } - - // Read the ModR/M byte - byte modRM = CodeBuffer[position++]; - Decoder.SetPosition(position); - - // Extract the fields from the ModR/M byte - byte mod = (byte)((modRM & 0xC0) >> 6); - byte reg = (byte)((modRM & 0x38) >> 3); // Should be 4 for AND - byte rm = (byte)(modRM & 0x07); - - // Decode the destination operand - string destOperand = ModRMDecoder.DecodeModRM(mod, rm, false); - - // Read the immediate value (sign-extended from 8 to 32 bits) - if (position >= Length) - { - return false; - } - - sbyte imm8 = (sbyte)CodeBuffer[position]; - int imm32 = imm8; // Sign-extend to 32 bits - Decoder.SetPosition(position + 1); - - // Set the operands - instruction.Operands = $"{destOperand}, 0x{imm32:X8}"; - - return true; - } -} diff --git a/X86Disassembler/X86/Handlers/InstructionHandlerFactory.cs b/X86Disassembler/X86/Handlers/InstructionHandlerFactory.cs index 2ad5a02..ca783d4 100644 --- a/X86Disassembler/X86/Handlers/InstructionHandlerFactory.cs +++ b/X86Disassembler/X86/Handlers/InstructionHandlerFactory.cs @@ -114,10 +114,6 @@ public class InstructionHandlerFactory _handlers.Add(new SbbImmFromRm32Handler(_codeBuffer, _decoder, _length)); _handlers.Add(new SbbImmFromRm32SignExtendedHandler(_codeBuffer, _decoder, _length)); - // AND handlers - _handlers.Add(new AndImmWithRm32Handler(_codeBuffer, _decoder, _length)); - _handlers.Add(new AndImmWithRm32SignExtendedHandler(_codeBuffer, _decoder, _length)); - // SUB handlers _handlers.Add(new SubImmFromRm32Handler(_codeBuffer, _decoder, _length)); _handlers.Add(new SubImmFromRm32SignExtendedHandler(_codeBuffer, _decoder, _length)); diff --git a/X86DisassemblerTests/SequenceDebuggingTests.cs b/X86DisassemblerTests/SequenceDebuggingTests.cs deleted file mode 100644 index eaddd77..0000000 --- a/X86DisassemblerTests/SequenceDebuggingTests.cs +++ /dev/null @@ -1,90 +0,0 @@ -namespace X86DisassemblerTests; - -using System; -using Xunit; -using X86Disassembler.X86; -using X86Disassembler.X86.Handlers; -using X86Disassembler.X86.Handlers.ArithmeticImmediate; -using X86Disassembler.X86.Handlers.Inc; - -/// -/// Tests for debugging the specific problematic sequence -/// -public class SequenceDebuggingTests -{ - /// - /// Tests each byte in the problematic sequence individually - /// - [Fact] - public void Debug_ProblematicSequence_ByteByByte() - { - // The problematic sequence - byte[] fullSequence = new byte[] { 0x08, 0x83, 0xC1, 0x04, 0x50, 0xE8, 0x42, 0x01, 0x00, 0x00 }; - - // Test each byte individually - for (int i = 0; i < fullSequence.Length; i++) - { - byte opcode = fullSequence[i]; - string expectedMnemonic = GetExpectedMnemonic(opcode); - - // Create a buffer with just this byte - byte[] buffer = new byte[] { opcode }; - var decoder = new InstructionDecoder(buffer, buffer.Length); - var factory = new InstructionHandlerFactory(buffer, decoder, buffer.Length); - - // Get the handler for this opcode - var handler = factory.GetHandler(opcode); - - // Output debug information - Console.WriteLine($"Byte 0x{opcode:X2} at position {i}: Handler = {(handler != null ? handler.GetType().Name : "null")}"); - - // If we have a handler, decode the instruction - if (handler != null) - { - var instruction = new Instruction(); - bool success = handler.Decode(opcode, instruction); - Console.WriteLine($" Decoded as: {instruction.Mnemonic} {instruction.Operands}"); - } - } - - // Now test the specific sequence 0x83 0xC1 0x04 (ADD ecx, 0x04) - byte[] addSequence = new byte[] { 0x83, 0xC1, 0x04 }; - var addDecoder = new InstructionDecoder(addSequence, addSequence.Length); - var addInstruction = addDecoder.DecodeInstruction(); - - Console.WriteLine($"\nDecoding 0x83 0xC1 0x04 directly: {addInstruction?.Mnemonic} {addInstruction?.Operands}"); - - // Now test the sequence 0x08 0x83 0xC1 0x04 - byte[] orAddSequence = new byte[] { 0x08, 0x83, 0xC1, 0x04 }; - var orAddDecoder = new InstructionDecoder(orAddSequence, orAddSequence.Length); - - // Decode the first instruction (0x08) - var orInstruction = orAddDecoder.DecodeInstruction(); - Console.WriteLine($"\nDecoding 0x08 in sequence 0x08 0x83 0xC1 0x04: {orInstruction?.Mnemonic} {orInstruction?.Operands}"); - - // Decode the second instruction (0x83 0xC1 0x04) - var secondInstruction = orAddDecoder.DecodeInstruction(); - Console.WriteLine($"Decoding 0x83 0xC1 0x04 after 0x08: {secondInstruction?.Mnemonic} {secondInstruction?.Operands}"); - - // Assert that we get the expected mnemonic for the second instruction - Assert.Equal("add", secondInstruction?.Mnemonic); - } - - /// - /// Gets the expected mnemonic for a given opcode - /// - private string GetExpectedMnemonic(byte opcode) - { - return opcode switch - { - 0x08 => "or", - 0x83 => "add", // Assuming reg field is 0 (ADD) - 0x50 => "push", - 0xE8 => "call", - 0x40 => "inc", - 0x41 => "inc", - 0x42 => "inc", - _ => "??" - }; - } -}