diff options
Diffstat (limited to 'src/arch/x86')
| -rw-r--r-- | src/arch/x86/instruction.h | 3 | ||||
| -rw-r--r-- | src/arch/x86/op_sub.c | 73 | ||||
| -rw-r--r-- | src/arch/x86/opcodes.h | 6 | ||||
| -rw-r--r-- | src/arch/x86/processor.c | 3 |
4 files changed, 85 insertions, 0 deletions
diff --git a/src/arch/x86/instruction.h b/src/arch/x86/instruction.h index 0092ba0..d731279 100644 --- a/src/arch/x86/instruction.h +++ b/src/arch/x86/instruction.h @@ -43,6 +43,9 @@ typedef enum _X86Opcodes X86_OP_SUB_R1632_RM1632, /* sub ([0x66] 0x29) */ + X86_OP_SUB_AL_IMM8, /* sub (0x2c) */ + X86_OP_SUB_E_AX_IMM1632, /* sub ([0x66] 0x2d) */ + X86_OP_XOR_RM8_R8, /* xor (0x30) */ X86_OP_XOR_RM1632_R1632, /* xor ([0x66] 0x31) */ X86_OP_XOR_R8_RM8, /* xor (0x32) */ diff --git a/src/arch/x86/op_sub.c b/src/arch/x86/op_sub.c index 6978a26..6d264f5 100644 --- a/src/arch/x86/op_sub.c +++ b/src/arch/x86/op_sub.c @@ -38,6 +38,79 @@ * offset = adresse virtuelle de l'instruction. * * proc = architecture ciblée par le désassemblage. * * * +* Description : Décode une instruction de type 'sub al, ...' (8 bits). * +* * +* Retour : Instruction mise en place ou NULL. * +* * +* Remarques : - * +* * +******************************************************************************/ + +asm_x86_instr *x86_read_instr_sub_al_with_imm8(const uint8_t *data, off_t *pos, off_t len, uint64_t offset, const asm_x86_processor *proc) +{ + asm_x86_instr *result; /* Instruction à retourner */ + + result = (asm_x86_instr *)calloc(1, sizeof(asm_x86_instr)); + + ASM_INSTRUCTION(result)->opcode = data[(*pos)++]; + + if (!x86_read_two_operands(result, data, pos, len, X86_OTP_AL, X86_OTP_IMM8)) + { + free(result); + return NULL; + } + + return result; + +} + + +/****************************************************************************** +* * +* Paramètres : data = flux de données à analyser. * +* pos = position courante dans ce flux. [OUT] * +* len = taille totale des données à analyser. * +* offset = adresse virtuelle de l'instruction. * +* proc = architecture ciblée par le désassemblage. * +* * +* Description : Décode une instruction de type 'sub [e]ax, ...' (16/32 bits).* +* * +* Retour : Instruction mise en place ou NULL. * +* * +* Remarques : - * +* * +******************************************************************************/ + +asm_x86_instr *x86_read_instr_sub_e_ax_with_imm1632(const uint8_t *data, off_t *pos, off_t len, uint64_t offset, const asm_x86_processor *proc) +{ + asm_x86_instr *result; /* Instruction à retourner */ + AsmOperandSize oprsize; /* Taille des opérandes */ + + result = (asm_x86_instr *)calloc(1, sizeof(asm_x86_instr)); + + oprsize = switch_x86_operand_size_if_needed(proc, data, pos); + + ASM_INSTRUCTION(result)->opcode = data[(*pos)++]; + + if (!x86_read_two_operands(result, data, pos, len, X86_OTP_E_AX, X86_OTP_IMM1632, oprsize)) + { + free(result); + return NULL; + } + + return result; + +} + + +/****************************************************************************** +* * +* Paramètres : data = flux de données à analyser. * +* pos = position courante dans ce flux. [OUT] * +* len = taille totale des données à analyser. * +* offset = adresse virtuelle de l'instruction. * +* proc = architecture ciblée par le désassemblage. * +* * * Description : Décode une instruction de type 'sub' (16 ou 32 bits). * * * * Retour : Instruction mise en place ou NULL. * diff --git a/src/arch/x86/opcodes.h b/src/arch/x86/opcodes.h index 54398d3..9bc5322 100644 --- a/src/arch/x86/opcodes.h +++ b/src/arch/x86/opcodes.h @@ -214,6 +214,12 @@ asm_x86_instr *x86_read_instr_shl_rm1632_imm8(const uint8_t *, off_t *, off_t, u /* Décode une instruction de type 'shr' (8 bits). */ asm_x86_instr *x86_read_instr_shr_rm1632_imm8(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); +/* Décode une instruction de type 'sub al, ...' (8 bits). */ +asm_x86_instr *x86_read_instr_sub_al_with_imm8(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); + +/* Décode une instruction de type 'sub [e]ax, ...' (16/32 bits). */ +asm_x86_instr *x86_read_instr_sub_e_ax_with_imm1632(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); + /* Décode une instruction de type 'sub'. */ asm_x86_instr *x86_read_instr_sub_imm8_from_rm1632(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); diff --git a/src/arch/x86/processor.c b/src/arch/x86/processor.c index 820c6a1..c6a116a 100644 --- a/src/arch/x86/processor.c +++ b/src/arch/x86/processor.c @@ -243,6 +243,9 @@ void x86_register_instructions(asm_x86_processor *proc) register_opcode_1632(proc->opcodes[X86_OP_SUB_R1632_RM1632], 0x29, "sub", x86_read_instr_sub_r1632_from_rm1632); + register_opcode(proc->opcodes[X86_OP_SUB_AL_IMM8], 0x2c, "sub", x86_read_instr_sub_al_with_imm8); + register_opcode_1632(proc->opcodes[X86_OP_SUB_E_AX_IMM1632], 0x2d, "sub", x86_read_instr_sub_e_ax_with_imm1632); + register_opcode(proc->opcodes[X86_OP_XOR_RM8_R8], 0x30, "xor", x86_read_instr_xor_rm8_with_r8); register_opcode_1632(proc->opcodes[X86_OP_XOR_RM1632_R1632], 0x31, "xor", x86_read_instr_xor_rm1632_with_r1632); register_opcode(proc->opcodes[X86_OP_XOR_R8_RM8], 0x32, "xor", x86_read_instr_xor_r8_with_rm8); |