/* OpenIDA - Outil d'analyse de fichiers binaires * op_pop.c - décodage des dépilements * * Copyright (C) 2008 Cyrille Bagard * * This file is part of OpenIDA. * * OpenIDA is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * OpenIDA is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with Foobar. If not, see . */ #include #include "../instruction-int.h" #include "opcodes.h" #include "operand.h" /****************************************************************************** * * * Paramètres : data = flux de données à analyser. * * pos = position courante dans ce flux. [OUT] * * len = taille totale des données à analyser. * * * * Description : Décode une instruction de type 'pop' (16 ou 32 bits). * * * * Retour : Instruction mise en place ou NULL. * * * * Remarques : - * * * ******************************************************************************/ asm_x86_instr *read_instr_pop_1632(const uint8_t *data, off_t *pos, off_t len) { asm_x86_instr *result; /* Instruction à retourner */ bool is_reg32; /* Implique un registre 32 bits*/ asm_x86_operand *reg; /* Registre de destination */ result = (asm_x86_instr *)calloc(1, sizeof(asm_x86_instr)); /* Utilisation des registres 32 bits ? */ is_reg32 = (data[*pos] != 0x66); if (!is_reg32) { (*pos)++; } ASM_INSTRUCTION(result)->opcode = data[*pos]; reg = x86_create_reg1632_operand(data[(*pos)++], is_reg32, 0x58); if (reg == NULL) { free(result); return NULL; } ASM_INSTRUCTION(result)->operands = (asm_operand **)calloc(1, sizeof(asm_operand *)); ASM_INSTRUCTION(result)->operands_count = 1; ASM_INSTRUCTION(result)->operands[0] = ASM_OPERAND(reg); return result; }