namespace X86Disassembler.X86.Handlers.And; /// /// Handler for AND r/m8, imm8 instruction (0x80 /4) /// public class AndImmToRm8Handler : InstructionHandler { /// /// Initializes a new instance of the AndImmToRm8Handler class /// /// The buffer containing the code to decode /// The instruction decoder that owns this handler /// The length of the buffer public AndImmToRm8Handler(byte[] codeBuffer, InstructionDecoder decoder, int length) : base(codeBuffer, decoder, length) { } /// /// Checks if this handler can decode the given opcode /// /// The opcode to check /// True if this handler can decode the opcode public override bool CanHandle(byte opcode) { if (opcode != 0x80) { return false; } // Check if we have enough bytes to read the ModR/M byte int position = Decoder.GetPosition(); if (position >= Length) { return false; } // Read the ModR/M byte to check the reg field (bits 5-3) byte modRM = CodeBuffer[position]; int reg = (modRM >> 3) & 0x7; // reg = 4 means AND operation return reg == 4; } /// /// Decodes an AND r/m8, imm8 instruction /// /// The opcode of the instruction /// The instruction object to populate /// True if the instruction was successfully decoded public override bool Decode(byte opcode, Instruction instruction) { // Set the mnemonic instruction.Mnemonic = "and"; int position = Decoder.GetPosition(); // Read the ModR/M byte var (mod, reg, rm, memOperand) = ModRMDecoder.ReadModRM(); // Read immediate value if (position >= Length) { // Incomplete instruction if (mod == 3) { string rmRegName = ModRMDecoder.GetRegisterName(rm, 8); instruction.Operands = $"{rmRegName}, ??"; } else { instruction.Operands = $"byte ptr {memOperand}, ??"; } return true; } byte imm8 = Decoder.ReadByte(); // Set operands if (mod == 3) { string rmRegName = ModRMDecoder.GetRegisterName(rm, 8); instruction.Operands = $"{rmRegName}, 0x{imm8:X2}"; } else { instruction.Operands = $"byte ptr {memOperand}, 0x{imm8:X2}"; } return true; } }