namespace X86DisassemblerTests; using System; using Xunit; using X86Disassembler.X86; /// /// Tests for Group 1 sign-extended immediate instructions (0x83 opcode) /// public class Group1SignExtendedHandlerTests { /// /// Tests that the disassembler correctly handles ADD ecx, imm8 instruction (0x83 0xC1 0x04) /// [Fact] public void Disassembler_HandlesAddEcxImm8_Correctly() { // Arrange // ADD ecx, 0x04 (83 C1 04) byte[] codeBuffer = new byte[] { 0x83, 0xC1, 0x04 }; var decoder = new InstructionDecoder(codeBuffer, codeBuffer.Length); // Act var instruction = decoder.DecodeInstruction(); // Assert Assert.NotNull(instruction); Assert.Equal("add", instruction.Mnemonic); Assert.Equal("ecx, 0x00000004", instruction.Operands); } /// /// Tests that the disassembler correctly handles the specific sequence from address 0x00001874 /// [Fact] public void Disassembler_HandlesSpecificSequence_Correctly() { // Arrange // This is the sequence from the problematic example: // 08 83 C1 04 50 E8 42 01 00 00 byte[] codeBuffer = new byte[] { 0x08, 0x83, 0xC1, 0x04, 0x50, 0xE8, 0x42, 0x01, 0x00, 0x00 }; var disassembler = new Disassembler(codeBuffer, 0); // Act var instructions = disassembler.Disassemble(); // Assert Assert.True(instructions.Count >= 3, $"Expected at least 3 instructions, but got {instructions.Count}"); // First instruction should be OR r/m8, r8 (but might be incomplete) Assert.Equal("or", instructions[0].Mnemonic); // Second instruction should be ADD ecx, 0x04 Assert.Equal("add", instructions[1].Mnemonic); Assert.Equal("ecx, 0x00000004", instructions[1].Operands); // Third instruction should be PUSH eax Assert.Equal("push", instructions[2].Mnemonic); Assert.Equal("eax", instructions[2].Operands); } }