1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 // Definition of MiniDisassembler.
7 #ifndef SANDBOX_SRC_SIDESTEP_MINI_DISASSEMBLER_H__
8 #define SANDBOX_SRC_SIDESTEP_MINI_DISASSEMBLER_H__
10 #include "sandbox/win/src/sidestep/mini_disassembler_types.h"
14 // This small disassembler is very limited
15 // in its functionality, and in fact does only the bare minimum required by the
16 // preamble patching utility. It may be useful for other purposes, however.
18 // The limitations include at least the following:
19 // -# No support for coprocessor opcodes, MMX, etc.
20 // -# No machine-readable identification of opcodes or decoding of
21 // assembly parameters. The name of the opcode (as a string) is given,
22 // however, to aid debugging.
24 // You may ask what this little disassembler actually does, then? The answer is
25 // that it does the following, which is exactly what the patching utility needs:
26 // -# Indicates if opcode is a jump (any kind) or a return (any kind)
27 // because this is important for the patching utility to determine if
28 // a function is too short or there are jumps too early in it for it
29 // to be preamble patched.
30 // -# The opcode length is always calculated, so that the patching utility
31 // can figure out where the next instruction starts, and whether it
32 // already has enough instructions to replace with the absolute jump
33 // to the patching code.
35 // The usage is quite simple; just create a MiniDisassembler and use its
36 // Disassemble() method.
38 // If you would like to extend this disassembler, please refer to the
39 // IA-32 Intel Architecture Software Developer's Manual Volume 2:
40 // Instruction Set Reference for information about operand decoding
42 class MiniDisassembler
{
45 // Creates a new instance and sets defaults.
47 // operand_default_32_bits: If true, the default operand size is
48 // set to 32 bits, which is the default under Win32. Otherwise it is 16 bits.
49 // address_default_32_bits: If true, the default address size is
50 // set to 32 bits, which is the default under Win32. Otherwise it is 16 bits.
51 MiniDisassembler(bool operand_default_32_bits
,
52 bool address_default_32_bits
);
54 // Equivalent to MiniDisassembler(true, true);
57 // Attempts to disassemble a single instruction starting from the
58 // address in memory it is pointed to.
60 // start: Address where disassembly should start.
61 // instruction_bytes: Variable that will be incremented by
62 // the length in bytes of the instruction.
63 // Returns enItJump, enItReturn or enItGeneric on success. enItUnknown
64 // if unable to disassemble, enItUnused if this seems to be an unused
65 // opcode. In the last two (error) cases, cbInstruction will be set
68 // Postcondition: This instance of the disassembler is ready to be used again,
69 // with unchanged defaults from creation time.
70 InstructionType
Disassemble(unsigned char* start
,
71 unsigned int* instruction_bytes
);
75 // Makes the disassembler ready for reuse.
78 // Sets the flags for address and operand sizes.
79 // Returns Number of prefix bytes.
80 InstructionType
ProcessPrefixes(unsigned char* start
, unsigned int* size
);
82 // Sets the flag for whether we have ModR/M, and increments
83 // operand_bytes_ if any are specifies by the opcode directly.
84 // Returns Number of opcode bytes.
85 InstructionType
ProcessOpcode(unsigned char* start
,
89 // Checks the type of the supplied operand. Increments
90 // operand_bytes_ if it directly indicates an immediate etc.
91 // operand. Asserts have_modrm_ if the operand specifies
93 bool ProcessOperand(int flag_operand
);
95 // Increments operand_bytes_ by size specified by ModR/M and
97 // Returns 0 in case of error, 1 if there is just a ModR/M byte,
98 // 2 if there is a ModR/M byte and a SIB byte.
99 bool ProcessModrm(unsigned char* start
, unsigned int* size
);
101 // Processes the SIB byte that it is pointed to.
102 // start: Pointer to the SIB byte.
103 // mod: The mod field from the ModR/M byte.
104 // Returns 1 to indicate success (indicates 1 SIB byte)
105 bool ProcessSib(unsigned char* start
, unsigned char mod
, unsigned int* size
);
107 // The instruction type we have decoded from the opcode.
108 InstructionType instruction_type_
;
110 // Counts the number of bytes that is occupied by operands in
111 // the current instruction (note: we don't care about how large
112 // operands stored in registers etc. are).
113 unsigned int operand_bytes_
;
115 // True iff there is a ModR/M byte in this instruction.
118 // True iff we need to decode the ModR/M byte (sometimes it just
119 // points to a register, we can tell by the addressing mode).
120 bool should_decode_modrm_
;
122 // Current operand size is 32 bits if true, 16 bits if false.
123 bool operand_is_32_bits_
;
125 // Default operand size is 32 bits if true, 16 bits if false.
126 bool operand_default_is_32_bits_
;
128 // Current address size is 32 bits if true, 16 bits if false.
129 bool address_is_32_bits_
;
131 // Default address size is 32 bits if true, 16 bits if false.
132 bool address_default_is_32_bits_
;
134 // Huge big opcode table based on the IA-32 manual, defined
135 // in Ia32OpcodeMap.cpp
136 static const OpcodeTable s_ia32_opcode_map_
[];
138 // Somewhat smaller table to help with decoding ModR/M bytes
139 // when 16-bit addressing mode is being used. Defined in
141 static const ModrmEntry s_ia16_modrm_map_
[];
143 // Somewhat smaller table to help with decoding ModR/M bytes
144 // when 32-bit addressing mode is being used. Defined in
146 static const ModrmEntry s_ia32_modrm_map_
[];
148 // Indicators of whether we got certain prefixes that certain
149 // silly Intel instructions depend on in nonstandard ways for
151 bool got_f2_prefix_
, got_f3_prefix_
, got_66_prefix_
;
154 }; // namespace sidestep
156 #endif // SANDBOX_SRC_SIDESTEP_MINI_DISASSEMBLER_H__