1 /* disasm.c where all the _work_ gets done in the Netwide Disassembler
3 * The Netwide Assembler is copyright (C) 1996 Simon Tatham and
4 * Julian Hall. All rights reserved. The software is
5 * redistributable under the licence given in the file "Licence"
6 * distributed in the NASM archive.
8 * initial version 27/iii/95 by Simon Tatham
21 extern struct itemplate
**itable
[];
24 * Flags that go into the `segment' field of `insn' structures
27 #define SEG_RELATIVE 1
34 #define SEG_SIGNED 128
36 static int whichreg(long regflags
, int regval
)
38 static int reg32
[] = {
39 R_EAX
, R_ECX
, R_EDX
, R_EBX
, R_ESP
, R_EBP
, R_ESI
, R_EDI
};
40 static int reg16
[] = {
41 R_AX
, R_CX
, R_DX
, R_BX
, R_SP
, R_BP
, R_SI
, R_DI
};
43 R_AL
, R_CL
, R_DL
, R_BL
, R_AH
, R_CH
, R_DH
, R_BH
};
45 R_ES
, R_CS
, R_SS
, R_DS
, R_FS
, R_GS
, 0, 0 };
47 R_CR0
, 0, R_CR2
, R_CR3
, R_CR4
, 0, 0, 0 };
49 R_DR0
, R_DR1
, R_DR2
, R_DR3
, 0, 0, R_DR6
, R_DR7
};
51 0, 0, 0, R_TR3
, R_TR4
, R_TR5
, R_TR6
, R_TR7
};
52 static int fpureg
[] = {
53 R_ST0
, R_ST1
, R_ST2
, R_ST3
, R_ST4
, R_ST5
, R_ST6
, R_ST7
};
54 static int mmxreg
[] = {
55 R_MM0
, R_MM1
, R_MM2
, R_MM3
, R_MM4
, R_MM5
, R_MM6
, R_MM7
};
56 static int xmmreg
[] = {
57 R_XMM0
, R_XMM1
, R_XMM2
, R_XMM3
, R_XMM4
, R_XMM5
, R_XMM6
, R_XMM7
};
59 if (!(REG_AL
& ~regflags
))
61 if (!(REG_AX
& ~regflags
))
63 if (!(REG_EAX
& ~regflags
))
65 if (!(REG_DX
& ~regflags
))
67 if (!(REG_CL
& ~regflags
))
69 if (!(REG_CX
& ~regflags
))
71 if (!(REG_ECX
& ~regflags
))
73 if (!(REG_CR4
& ~regflags
))
75 if (!(FPU0
& ~regflags
))
77 if (!(REG_CS
& ~regflags
))
79 if (!(REG_DESS
& ~regflags
))
80 return (regval
== 0 || regval
== 2 || regval
== 3 ? sreg
[regval
] : 0);
81 if (!(REG_FSGS
& ~regflags
))
82 return (regval
== 4 || regval
== 5 ? sreg
[regval
] : 0);
83 if (!((REGMEM
|BITS8
) & ~regflags
))
85 if (!((REGMEM
|BITS16
) & ~regflags
))
87 if (!((REGMEM
|BITS32
) & ~regflags
))
89 if (!(REG_SREG
& ~regflags
))
91 if (!(REG_CREG
& ~regflags
))
93 if (!(REG_DREG
& ~regflags
))
95 if (!(REG_TREG
& ~regflags
))
97 if (!(FPUREG
& ~regflags
))
98 return fpureg
[regval
];
99 if (!(MMXREG
& ~regflags
))
100 return mmxreg
[regval
];
101 if (!(XMMREG
& ~regflags
))
102 return xmmreg
[regval
];
106 static char *whichcond(int condval
)
108 static int conds
[] = {
109 C_O
, C_NO
, C_C
, C_NC
, C_Z
, C_NZ
, C_NA
, C_A
,
110 C_S
, C_NS
, C_PE
, C_PO
, C_L
, C_NL
, C_NG
, C_G
112 return conditions
[conds
[condval
]];
116 * Process an effective address (ModRM) specification.
118 static unsigned char *do_ea (unsigned char *data
, int modrm
, int asize
,
119 int segsize
, operand
*op
)
121 int mod
, rm
, scale
, index
, base
;
123 mod
= (modrm
>> 6) & 03;
126 if (mod
== 3) { /* pure register version */
128 op
->segment
|= SEG_RMREG
;
136 * <mod> specifies the displacement size (none, byte or
137 * word), and <rm> specifies the register combination.
138 * Exception: mod=0,rm=6 does not specify [BP] as one might
139 * expect, but instead specifies [disp16].
141 op
->indexreg
= op
->basereg
= -1;
142 op
->scale
= 1; /* always, in 16 bits */
144 case 0: op
->basereg
= R_BX
; op
->indexreg
= R_SI
; break;
145 case 1: op
->basereg
= R_BX
; op
->indexreg
= R_DI
; break;
146 case 2: op
->basereg
= R_BP
; op
->indexreg
= R_SI
; break;
147 case 3: op
->basereg
= R_BP
; op
->indexreg
= R_DI
; break;
148 case 4: op
->basereg
= R_SI
; break;
149 case 5: op
->basereg
= R_DI
; break;
150 case 6: op
->basereg
= R_BP
; break;
151 case 7: op
->basereg
= R_BX
; break;
153 if (rm
== 6 && mod
== 0) { /* special case */
157 mod
= 2; /* fake disp16 */
161 op
->segment
|= SEG_NODISP
;
164 op
->segment
|= SEG_DISP8
;
165 op
->offset
= (signed char) *data
++;
168 op
->segment
|= SEG_DISP16
;
169 op
->offset
= *data
++;
170 op
->offset
|= (*data
++) << 8;
176 * Once again, <mod> specifies displacement size (this time
177 * none, byte or *dword*), while <rm> specifies the base
178 * register. Again, [EBP] is missing, replaced by a pure
179 * disp32 (this time that's mod=0,rm=*5*). However, rm=4
180 * indicates not a single base register, but instead the
181 * presence of a SIB byte...
185 case 0: op
->basereg
= R_EAX
; break;
186 case 1: op
->basereg
= R_ECX
; break;
187 case 2: op
->basereg
= R_EDX
; break;
188 case 3: op
->basereg
= R_EBX
; break;
189 case 5: op
->basereg
= R_EBP
; break;
190 case 6: op
->basereg
= R_ESI
; break;
191 case 7: op
->basereg
= R_EDI
; break;
193 if (rm
== 5 && mod
== 0) {
197 mod
= 2; /* fake disp32 */
199 if (rm
== 4) { /* process SIB */
200 scale
= (*data
>> 6) & 03;
201 index
= (*data
>> 3) & 07;
205 op
->scale
= 1 << scale
;
207 case 0: op
->indexreg
= R_EAX
; break;
208 case 1: op
->indexreg
= R_ECX
; break;
209 case 2: op
->indexreg
= R_EDX
; break;
210 case 3: op
->indexreg
= R_EBX
; break;
211 case 4: op
->indexreg
= -1; break;
212 case 5: op
->indexreg
= R_EBP
; break;
213 case 6: op
->indexreg
= R_ESI
; break;
214 case 7: op
->indexreg
= R_EDI
; break;
218 case 0: op
->basereg
= R_EAX
; break;
219 case 1: op
->basereg
= R_ECX
; break;
220 case 2: op
->basereg
= R_EDX
; break;
221 case 3: op
->basereg
= R_EBX
; break;
222 case 4: op
->basereg
= R_ESP
; break;
223 case 6: op
->basereg
= R_ESI
; break;
224 case 7: op
->basereg
= R_EDI
; break;
236 op
->segment
|= SEG_NODISP
;
239 op
->segment
|= SEG_DISP8
;
240 op
->offset
= (signed char) *data
++;
243 op
->segment
|= SEG_DISP32
;
244 op
->offset
= *data
++;
245 op
->offset
|= (*data
++) << 8;
246 op
->offset
|= ((long) *data
++) << 16;
247 op
->offset
|= ((long) *data
++) << 24;
255 * Determine whether the code string in r corresponds to the data
256 * stream in data. Return the number of bytes matched if so.
258 static int matches (unsigned char *r
, unsigned char *data
, int asize
,
259 int osize
, int segsize
, insn
*ins
)
261 unsigned char * origdata
= data
;
262 int a_used
= FALSE
, o_used
= FALSE
;
267 if (c
>= 01 && c
<= 03) {
274 case 0x07: ins
->oprs
[0].basereg
= 0; break;
275 case 0x17: ins
->oprs
[0].basereg
= 2; break;
276 case 0x1F: ins
->oprs
[0].basereg
= 3; break;
277 default: return FALSE
;
282 case 0xA1: ins
->oprs
[0].basereg
= 4; break;
283 case 0xA9: ins
->oprs
[0].basereg
= 5; break;
284 default: return FALSE
;
289 case 0x06: ins
->oprs
[0].basereg
= 0; break;
290 case 0x0E: ins
->oprs
[0].basereg
= 1; break;
291 case 0x16: ins
->oprs
[0].basereg
= 2; break;
292 case 0x1E: ins
->oprs
[0].basereg
= 3; break;
293 default: return FALSE
;
298 case 0xA0: ins
->oprs
[0].basereg
= 4; break;
299 case 0xA8: ins
->oprs
[0].basereg
= 5; break;
300 default: return FALSE
;
303 if (c
>= 010 && c
<= 012) {
304 int t
= *r
++, d
= *data
++;
305 if (d
< t
|| d
> t
+7)
308 ins
->oprs
[c
-010].basereg
= d
-t
;
309 ins
->oprs
[c
-010].segment
|= SEG_RMREG
;
315 if (c
>= 014 && c
<= 016) {
316 ins
->oprs
[c
-014].offset
= (signed char) *data
++;
317 ins
->oprs
[c
-014].segment
|= SEG_SIGNED
;
319 if (c
>= 020 && c
<= 022)
320 ins
->oprs
[c
-020].offset
= *data
++;
321 if (c
>= 024 && c
<= 026)
322 ins
->oprs
[c
-024].offset
= *data
++;
323 if (c
>= 030 && c
<= 032) {
324 ins
->oprs
[c
-030].offset
= *data
++;
325 ins
->oprs
[c
-030].offset
|= (*data
++ << 8);
327 if (c
>= 034 && c
<= 036) {
328 ins
->oprs
[c
-034].offset
= *data
++;
329 ins
->oprs
[c
-034].offset
|= (*data
++ << 8);
331 ins
->oprs
[c
-034].offset
|= (((long) *data
++) << 16);
332 ins
->oprs
[c
-034].offset
|= (((long) *data
++) << 24);
334 if (segsize
!= asize
)
335 ins
->oprs
[c
-034].addr_size
= asize
;
337 if (c
>= 040 && c
<= 042) {
338 ins
->oprs
[c
-040].offset
= *data
++;
339 ins
->oprs
[c
-040].offset
|= (*data
++ << 8);
340 ins
->oprs
[c
-040].offset
|= (((long) *data
++) << 16);
341 ins
->oprs
[c
-040].offset
|= (((long) *data
++) << 24);
343 if (c
>= 050 && c
<= 052) {
344 ins
->oprs
[c
-050].offset
= (signed char) *data
++;
345 ins
->oprs
[c
-050].segment
|= SEG_RELATIVE
;
347 if (c
>= 060 && c
<= 062) {
348 ins
->oprs
[c
-060].offset
= *data
++;
349 ins
->oprs
[c
-060].offset
|= (*data
++ << 8);
350 ins
->oprs
[c
-060].segment
|= SEG_RELATIVE
;
351 ins
->oprs
[c
-060].segment
&= ~SEG_32BIT
;
353 if (c
>= 064 && c
<= 066) {
354 ins
->oprs
[c
-064].offset
= *data
++;
355 ins
->oprs
[c
-064].offset
|= (*data
++ << 8);
357 ins
->oprs
[c
-064].offset
|= (((long) *data
++) << 16);
358 ins
->oprs
[c
-064].offset
|= (((long) *data
++) << 24);
359 ins
->oprs
[c
-064].segment
|= SEG_32BIT
;
361 ins
->oprs
[c
-064].segment
&= ~SEG_32BIT
;
362 ins
->oprs
[c
-064].segment
|= SEG_RELATIVE
;
363 if (segsize
!= asize
)
364 ins
->oprs
[c
-064].addr_size
= asize
;
366 if (c
>= 070 && c
<= 072) {
367 ins
->oprs
[c
-070].offset
= *data
++;
368 ins
->oprs
[c
-070].offset
|= (*data
++ << 8);
369 ins
->oprs
[c
-070].offset
|= (((long) *data
++) << 16);
370 ins
->oprs
[c
-070].offset
|= (((long) *data
++) << 24);
371 ins
->oprs
[c
-070].segment
|= SEG_32BIT
| SEG_RELATIVE
;
373 if (c
>= 0100 && c
<= 0177) {
375 ins
->oprs
[c
& 07].basereg
= (modrm
>> 3) & 07;
376 ins
->oprs
[c
& 07].segment
|= SEG_RMREG
;
377 data
= do_ea (data
, modrm
, asize
, segsize
,
378 &ins
->oprs
[(c
>> 3) & 07]);
380 if (c
>= 0200 && c
<= 0277) {
382 if (((modrm
>> 3) & 07) != (c
& 07))
383 return FALSE
; /* spare field doesn't match up */
384 data
= do_ea (data
, modrm
, asize
, segsize
,
385 &ins
->oprs
[(c
>> 3) & 07]);
387 if (c
>= 0300 && c
<= 0302) {
389 ins
->oprs
[c
-0300].segment
|= SEG_32BIT
;
391 ins
->oprs
[c
-0300].segment
&= ~SEG_32BIT
;
407 if (asize
!= segsize
)
425 if (osize
!= segsize
)
431 int t
= *r
++, d
= *data
++;
432 if (d
< t
|| d
> t
+15)
435 ins
->condition
= d
- t
;
440 * Check for unused a/o prefixes.
443 if (!a_used
&& asize
!= segsize
)
444 ins
->prefixes
[ins
->nprefix
++] = (asize
== 16 ? P_A16
: P_A32
);
445 if (!o_used
&& osize
!= segsize
)
446 ins
->prefixes
[ins
->nprefix
++] = (osize
== 16 ? P_O16
: P_O32
);
448 return data
- origdata
;
451 long disasm (unsigned char *data
, char *output
, int segsize
, long offset
,
452 int autosync
, unsigned long prefer
)
454 struct itemplate
**p
, **best_p
;
455 int length
, best_length
= 0;
457 int rep
, lock
, asize
, osize
, i
, slen
, colon
;
458 unsigned char *origdata
;
461 unsigned long goodness
, best
;
466 asize
= osize
= segsize
;
471 if (*data
== 0xF3 || *data
== 0xF2)
473 else if (*data
== 0xF0)
475 else if (*data
== 0x2E || *data
== 0x36 || *data
== 0x3E ||
476 *data
== 0x26 || *data
== 0x64 || *data
== 0x65) {
478 case 0x2E: segover
= "cs"; break;
479 case 0x36: segover
= "ss"; break;
480 case 0x3E: segover
= "ds"; break;
481 case 0x26: segover
= "es"; break;
482 case 0x64: segover
= "fs"; break;
483 case 0x65: segover
= "gs"; break;
485 } else if (*data
== 0x66)
486 osize
= 48 - segsize
, data
++;
487 else if (*data
== 0x67)
488 asize
= 48 - segsize
, data
++;
493 ins
.oprs
[0].segment
= ins
.oprs
[1].segment
= ins
.oprs
[2].segment
=
494 ins
.oprs
[0].addr_size
= ins
.oprs
[1].addr_size
= ins
.oprs
[2].addr_size
=
495 (segsize
== 16 ? 0 : SEG_32BIT
);
497 best
= ~0UL; /* Worst possible */
499 for (p
= itable
[*data
]; *p
; p
++) {
500 if ( (length
= matches((unsigned char *)((*p
)->code
), data
,
501 asize
, osize
, segsize
, &ins
)) ) {
504 * Final check to make sure the types of r/m match up.
506 for (i
= 0; i
< (*p
)->operands
; i
++) {
509 /* If it's a mem-only EA but we have a register, die. */
510 ((ins
.oprs
[i
].segment
& SEG_RMREG
) &&
511 !(MEMORY
& ~(*p
)->opd
[i
])) ||
513 /* If it's a reg-only EA but we have a memory ref, die. */
514 (!(ins
.oprs
[i
].segment
& SEG_RMREG
) &&
515 !(REGNORM
& ~(*p
)->opd
[i
]) &&
516 !((*p
)->opd
[i
] & REG_SMASK
)) ||
518 /* Register type mismatch (eg FS vs REG_DESS): die. */
519 ((((*p
)->opd
[i
] & (REGISTER
| FPUREG
)) ||
520 (ins
.oprs
[i
].segment
& SEG_RMREG
)) &&
521 !whichreg ((*p
)->opd
[i
], ins
.oprs
[i
].basereg
))) {
528 goodness
= ((*p
)->flags
& IF_PFMASK
) ^ prefer
;
529 if ( goodness
< best
) {
530 /* This is the best one found so far */
533 best_length
= length
;
540 return 0; /* no instruction was matched */
542 /* Pick the best match */
544 length
= best_length
;
549 slen
+= sprintf(output
+slen
, "rep%s ",
550 (rep
== 0xF2 ? "ne" :
551 (*p
)->opcode
== I_CMPSB
||
552 (*p
)->opcode
== I_CMPSW
||
553 (*p
)->opcode
== I_CMPSD
||
554 (*p
)->opcode
== I_SCASB
||
555 (*p
)->opcode
== I_SCASW
||
556 (*p
)->opcode
== I_SCASD
? "e" : ""));
559 slen
+= sprintf(output
+slen
, "lock ");
560 for (i
= 0; i
< ins
.nprefix
; i
++)
561 switch (ins
.prefixes
[i
]) {
562 case P_A16
: slen
+= sprintf(output
+slen
, "a16 "); break;
563 case P_A32
: slen
+= sprintf(output
+slen
, "a32 "); break;
564 case P_O16
: slen
+= sprintf(output
+slen
, "o16 "); break;
565 case P_O32
: slen
+= sprintf(output
+slen
, "o32 "); break;
568 for (i
= 0; i
< elements(ico
); i
++)
569 if ((*p
)->opcode
== ico
[i
]) {
570 slen
+= sprintf(output
+slen
, "%s%s", icn
[i
],
571 whichcond(ins
.condition
));
574 if (i
>= elements(ico
))
575 slen
+= sprintf(output
+slen
, "%s", insn_names
[(*p
)->opcode
]);
577 length
+= data
- origdata
; /* fix up for prefixes */
578 for (i
=0; i
<(*p
)->operands
; i
++) {
579 output
[slen
++] = (colon
? ':' : i
==0 ? ' ' : ',');
581 if (ins
.oprs
[i
].segment
& SEG_RELATIVE
) {
582 ins
.oprs
[i
].offset
+= offset
+ length
;
584 * sort out wraparound
586 if (!(ins
.oprs
[i
].segment
& SEG_32BIT
))
587 ins
.oprs
[i
].offset
&= 0xFFFF;
589 * add sync marker, if autosync is on
592 add_sync (ins
.oprs
[i
].offset
, 0L);
595 if ((*p
)->opd
[i
] & COLON
)
600 if (((*p
)->opd
[i
] & (REGISTER
| FPUREG
)) ||
601 (ins
.oprs
[i
].segment
& SEG_RMREG
))
603 ins
.oprs
[i
].basereg
= whichreg ((*p
)->opd
[i
],
604 ins
.oprs
[i
].basereg
);
605 if ( (*p
)->opd
[i
] & TO
)
606 slen
+= sprintf(output
+slen
, "to ");
607 slen
+= sprintf(output
+slen
, "%s",
608 reg_names
[ins
.oprs
[i
].basereg
-EXPR_REG_START
]);
609 } else if (!(UNITY
& ~(*p
)->opd
[i
])) {
610 output
[slen
++] = '1';
611 } else if ( (*p
)->opd
[i
] & IMMEDIATE
) {
612 if ( (*p
)->opd
[i
] & BITS8
) {
613 slen
+= sprintf(output
+slen
, "byte ");
614 if (ins
.oprs
[i
].segment
& SEG_SIGNED
) {
615 if (ins
.oprs
[i
].offset
< 0) {
616 ins
.oprs
[i
].offset
*= -1;
617 output
[slen
++] = '-';
619 output
[slen
++] = '+';
621 } else if ( (*p
)->opd
[i
] & BITS16
) {
622 slen
+= sprintf(output
+slen
, "word ");
623 } else if ( (*p
)->opd
[i
] & BITS32
) {
624 slen
+= sprintf(output
+slen
, "dword ");
625 } else if ( (*p
)->opd
[i
] & NEAR
) {
626 slen
+= sprintf(output
+slen
, "near ");
627 } else if ( (*p
)->opd
[i
] & SHORT
) {
628 slen
+= sprintf(output
+slen
, "short ");
630 slen
+= sprintf(output
+slen
, "0x%lx", ins
.oprs
[i
].offset
);
631 } else if ( !(MEM_OFFS
& ~(*p
)->opd
[i
]) ) {
632 slen
+= sprintf(output
+slen
, "[%s%s%s0x%lx]",
633 (segover
? segover
: ""),
634 (segover
? ":" : ""),
635 (ins
.oprs
[i
].addr_size
== 32 ? "dword " :
636 ins
.oprs
[i
].addr_size
== 16 ? "word " : ""),
639 } else if ( !(REGMEM
& ~(*p
)->opd
[i
]) ) {
641 if ( (*p
)->opd
[i
] & BITS8
)
642 slen
+= sprintf(output
+slen
, "byte ");
643 if ( (*p
)->opd
[i
] & BITS16
)
644 slen
+= sprintf(output
+slen
, "word ");
645 if ( (*p
)->opd
[i
] & BITS32
)
646 slen
+= sprintf(output
+slen
, "dword ");
647 if ( (*p
)->opd
[i
] & BITS64
)
648 slen
+= sprintf(output
+slen
, "qword ");
649 if ( (*p
)->opd
[i
] & BITS80
)
650 slen
+= sprintf(output
+slen
, "tword ");
651 if ( (*p
)->opd
[i
] & FAR
)
652 slen
+= sprintf(output
+slen
, "far ");
653 if ( (*p
)->opd
[i
] & NEAR
)
654 slen
+= sprintf(output
+slen
, "near ");
655 output
[slen
++] = '[';
656 if (ins
.oprs
[i
].addr_size
)
657 slen
+= sprintf(output
+slen
, "%s",
658 (ins
.oprs
[i
].addr_size
== 32 ? "dword " :
659 ins
.oprs
[i
].addr_size
== 16 ? "word " : ""));
661 slen
+= sprintf(output
+slen
, "%s:", segover
);
664 if (ins
.oprs
[i
].basereg
!= -1) {
665 slen
+= sprintf(output
+slen
, "%s",
666 reg_names
[(ins
.oprs
[i
].basereg
-
670 if (ins
.oprs
[i
].indexreg
!= -1) {
672 output
[slen
++] = '+';
673 slen
+= sprintf(output
+slen
, "%s",
674 reg_names
[(ins
.oprs
[i
].indexreg
-
676 if (ins
.oprs
[i
].scale
> 1)
677 slen
+= sprintf(output
+slen
, "*%d", ins
.oprs
[i
].scale
);
680 if (ins
.oprs
[i
].segment
& SEG_DISP8
) {
682 if (ins
.oprs
[i
].offset
& 0x80) {
683 ins
.oprs
[i
].offset
= - (signed char) ins
.oprs
[i
].offset
;
686 slen
+= sprintf(output
+slen
, "%c0x%lx", sign
,
688 } else if (ins
.oprs
[i
].segment
& SEG_DISP16
) {
690 output
[slen
++] = '+';
691 slen
+= sprintf(output
+slen
, "0x%lx", ins
.oprs
[i
].offset
);
692 } else if (ins
.oprs
[i
].segment
& SEG_DISP32
) {
694 output
[slen
++] = '+';
695 slen
+= sprintf(output
+slen
, "0x%lx", ins
.oprs
[i
].offset
);
697 output
[slen
++] = ']';
699 slen
+= sprintf(output
+slen
, "<operand%d>", i
);
703 if (segover
) { /* unused segment override */
707 p
[count
+3] = p
[count
];
708 strncpy (output
, segover
, 2);
714 long eatbyte (unsigned char *data
, char *output
)
716 sprintf(output
, "db 0x%02X", *data
);