private x86Operator Read_9x(byte b) { x86Operator _Operator = null; if (b == 0x90 && Length == 1) { _Operator = new x86Operator(Intelx86Opcode.Nop); } else if (b < 0x98) { _Operator = new x86Operator(Intelx86Opcode.Xchg); _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax); _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax + b - 0x90); } else if (b < 0x9A) { _Operator = new x86Operator(Intelx86Opcode.Cwtl + b - 0x98); } else if (b == 0x9A) { _Operator = new x86Operator(Intelx86Opcode.LCall); _Operator.Destination = extractLw(); _Operator.Source = extractLz(); } else if (b == 0x9B) { _Operator = new x86Operator(Intelx86Opcode.FWait); } else if (b < 0xA0) { _Operator = new x86Operator(Intelx86Opcode.Pushf + b - 0x9C); } else { throw new ArgumentException(); } return _Operator; }
private x86Operator Read_Ax(byte b) { x86Operator _Operator = null; if (b == 0xA0) { _Operator = new x86Operator(Intelx86Opcode.Mov); _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al); _Operator.Source = extractOb(); } else if (b == 0xA1) { _Operator = new x86Operator(Intelx86Opcode.Mov); _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax); _Operator.Source = extractOz(); } else if (b == 0xA2) { _Operator = new x86Operator(Intelx86Opcode.Mov); _Operator.Destination = extractOb(); _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Al); } else if (b == 0xA3) { _Operator = new x86Operator(Intelx86Opcode.Mov); _Operator.Destination = extractOz(); _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax); } else if (b == 0xA4) { _Operator = new x86Operator(Intelx86Opcode.Movs, OperatorSize.Byte); _Operator.Segment = Intelx86Register.Es; _Operator.SegmentSrc = Intelx86Register.Ds; _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi); } else if (b == 0xA5) { _Operator = new x86Operator(Intelx86Opcode.Movs, OperatorSize.DWord); _Operator.Segment = Intelx86Register.Es; _Operator.SegmentSrc = Intelx86Register.Ds; _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi); } else if (b == 0xA6) { _Operator = new x86Operator(Intelx86Opcode.Cmps, OperatorSize.Byte); _Operator.Segment = Intelx86Register.Ds; _Operator.SegmentSrc = Intelx86Register.Es; _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Esi); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Edi); } else if (b == 0xA7) { _Operator = new x86Operator(Intelx86Opcode.Cmps, OperatorSize.DWord); _Operator.Segment = Intelx86Register.Ds; _Operator.SegmentSrc = Intelx86Register.Es; _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Esi); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Edi); } else if (b == 0xA8) { long value = Buffer[X]; Length++; _Operator = new x86Operator(Intelx86Opcode.Test); _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al); _Operator.Source = x86Operand.NewValue(value); } else if (b == 0xA9) { long value = Buffer[X]; value |= (uint)Buffer[X + 1] << 8; value |= (uint)Buffer[X + 2] << 16; value |= (uint)Buffer[X + 3] << 24; Length += 4; _Operator = new x86Operator(Intelx86Opcode.Test); _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax); _Operator.Source = x86Operand.NewValue(value); } else if (b == 0xAA) { _Operator = new x86Operator(Intelx86Opcode.Stos); _Operator.Segment = Intelx86Register.Es; _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Al); _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi); } else if (b == 0xAB) { _Operator = new x86Operator(Intelx86Opcode.Stos); _Operator.Segment = Intelx86Register.Es; _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax); _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi); } else if (b == 0xAC) { _Operator = new x86Operator(Intelx86Opcode.Lods); _Operator.SegmentSrc = Intelx86Register.Ds; _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi); } else if (b == 0xAD) { _Operator = new x86Operator(Intelx86Opcode.Lods); _Operator.SegmentSrc = Intelx86Register.Ds; _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi); } else if (b == 0xAE) { _Operator = new x86Operator(Intelx86Opcode.Scas); _Operator.SegmentSrc = Intelx86Register.Es; _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Edi); } else if (b == 0xAF) { _Operator = new x86Operator(Intelx86Opcode.Scas); _Operator.SegmentSrc = Intelx86Register.Es; _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Edi); } else { throw new ArgumentException(); } return _Operator; }
private x86Operator Read_7x(byte b) { x86Operator _Operator = null; long value; value = (byte)Buffer[X]; if (value >= 0xfe) { value -= 256; } if (value >= 0x80) { value |= 0xffffff00; } Length++; _Operator = new x86Operator(Intelx86Opcode.Jo + (b & 0xF)); _Operator.Source = x86Operand.NewDisplacement(value + 2); return _Operator; }
private x86Operator Read_8x(byte b) { x86Operator _Operator = null; long value; if (b == 0x80) { b = Buffer[X]; Length++; int reg = (b >> 3) & 0x7; _Operator = new x86Operator(Intelx86Opcode.Add + reg, OperatorSize.Byte); _Operator.Destination = extractEb(b); value = (byte)Buffer[X]; Length++; _Operator.Source = x86Operand.NewValue(value); } else if (b == 0x81) { b = Buffer[X]; Length++; int reg = (b >> 3) & 0x7; _Operator = new x86Operator(Intelx86Opcode.Add + reg, OperatorSize.DWord); _Operator.Destination = extractEv(b); _Operator.Source = extractLz(); } else if (b == 0x82) { b = Buffer[X]; Length++; int reg = (b >> 3) & 0x7; _Operator = new x86Operator(Intelx86Opcode.Add + reg, OperatorSize.Byte); _Operator.Destination = extractEb(b); _Operator.Source = extractLb(); } else if (b == 0x83) { b = Buffer[X]; Length++; int reg = (b >> 3) & 0x7; _Operator = new x86Operator(Intelx86Opcode.Add + reg, OperatorSize.DWord); _Operator.Destination = extractEv(b); _Operator.Source = extractLb(); } else if (b < 0x88) { _Operator = new x86Operator(b < 0x86 ? Intelx86Opcode.Test : Intelx86Opcode.Xchg); if ((b & 1) == 0) { b = Buffer[X]; Length++; _Operator.Source = extractGb(b); _Operator.Destination = extractEb(b); } else { b = Buffer[X]; Length++; _Operator.Source = extractGv(b); _Operator.Destination = extractEv(b); } } else if (b == 0x88) { _Operator = new x86Operator(Intelx86Opcode.Mov); b = Buffer[X]; Length++; _Operator.Source = extractGb(b); _Operator.Destination = extractEb(b); } else if (b == 0x89) { _Operator = new x86Operator(Intelx86Opcode.Mov); b = Buffer[X]; Length++; _Operator.Source = extractGv(b); _Operator.Destination = extractEv(b); } else if (b == 0x8A) { _Operator = new x86Operator(Intelx86Opcode.Mov); b = Buffer[X]; Length++; _Operator.Source = extractEb(b); _Operator.Destination = extractGb(b); } else if (b == 0x8B) { _Operator = new x86Operator(Intelx86Opcode.Mov); b = Buffer[X]; Length++; _Operator.Source = extractEv(b); _Operator.Destination = extractGv(b); } else if (b == 0x8C) { _Operator = new x86Operator(Intelx86Opcode.Mov); b = Buffer[X]; Length++; _Operator.Source = extractSw(b); _Operator.Destination = extractEv(b); } else if (b == 0x8D) { _Operator = new x86Operator(Intelx86Opcode.Lea); b = Buffer[X]; Length++; _Operator.Source = extractMa(b); _Operator.Destination = extractGv(b); } else if (b == 0x8E) { _Operator = new x86Operator(Intelx86Opcode.Mov); b = Buffer[X]; Length++; _Operator.Destination = extractSw(b); _Operator.Source = extractEw(b); } else if (b == 0x8F) { b = Buffer[X]; Length++; int reg = (b >> 3) & 0x7; if (reg == 0) { _Operator = new x86Operator(Intelx86Opcode.Pop, OperatorSize.DWord); _Operator.Source = extractEv(b); } else { _Operator = new x86Operator(Intelx86Opcode.Bad); } } else throw new ArgumentException(); return _Operator; }
private x86Operator Read_5x(byte b) { x86Operator _Operator = null; _Operator = new x86Operator(b < 0x58 ? Intelx86Opcode.Push : Intelx86Opcode.Pop); _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax + (b & 0x7)); return _Operator; }
private x86Operator Read_6x(byte b) { x86Operator _Operator = null; if (b == 0x60) { _Operator = new x86Operator(Intelx86Opcode.Pusha); } else if (b == 0x61) { _Operator = new x86Operator(Intelx86Opcode.Popa); } else if (b == 0x62) { _Operator = new x86Operator(Intelx86Opcode.Bound); b = Buffer[X]; Length++; _Operator.Destination = extractMa(b); _Operator.Source = extractGv(b); if (_Operator.Destination == null) { Length--; _Operator = new x86Operator(Intelx86Opcode.Bad); } } else if (b == 0x63) { _Operator = new x86Operator(Intelx86Opcode.Arpl); b = Buffer[X]; Length++; _Operator.Destination = extractEw(b); _Operator.Source = extractGw(b); } else if (b == 0x64) { _Operator = Read_Segment(Intelx86Register.Fs); } else if (b == 0x65) { _Operator = Read_Segment(Intelx86Register.Gs); } else if (b == 0x66) { _Operator = Read(); if (_Operator.Destination.Register >= (int)Intelx86Register.Eax && _Operator.Destination.Register <= (int)Intelx86Register.Edi) { _Operator.Destination.Register -= 8; } if (_Operator.Source.Register >= (int)Intelx86Register.Eax && _Operator.Source.Register <= (int)Intelx86Register.Edi) { _Operator.Source.Register -= 8; } } else if (b == 0x68) { _Operator = new x86Operator(Intelx86Opcode.Push); _Operator.Source = extractLz(); } else if (b == 0x69) { _Operator = new x86Operator(Intelx86Opcode.IMul); b = Buffer[X]; Length++; _Operator.ThirdOpad = extractGv(b); _Operator.Destination = extractEv(b); _Operator.Source = extractLz(); } else if (b == 0x6a) { _Operator = new x86Operator(Intelx86Opcode.Push); _Operator.Source = extractLb(); } else if (b == 0x6b) { _Operator = new x86Operator(Intelx86Opcode.IMul); b = Buffer[X]; Length++; _Operator.ThirdOpad = extractGv(b); _Operator.Destination = extractEv(b); _Operator.Source = extractLb(); } else if (b == 0x6c) { _Operator = new x86Operator(Intelx86Opcode.Ins, OperatorSize.Byte); _Operator.Segment = Intelx86Register.Es; _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Dx); } else if (b == 0x6d) { _Operator = new x86Operator(Intelx86Opcode.Ins, OperatorSize.DWord); _Operator.Segment = Intelx86Register.Es; _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Dx); } else if (b == 0x6e) { _Operator = new x86Operator(Intelx86Opcode.Outs, OperatorSize.Byte); _Operator.SegmentSrc = Intelx86Register.Ds; _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Dx); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi); } else if (b == 0x6f) { _Operator = new x86Operator(Intelx86Opcode.Outs, OperatorSize.DWord); _Operator.SegmentSrc = Intelx86Register.Ds; _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Dx); _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi); } else { throw new ArgumentException(); } return _Operator; }
private x86Operator Read_0F_8x(byte b) { x86Operator _Operator = null; long value; value = Buffer[X]; value |= (uint)Buffer[X + 1] << 8; value |= (uint)Buffer[X + 2] << 16; value |= (uint)Buffer[X + 3] << 24; Length += 4; _Operator = new x86Operator(Intelx86Opcode.Jo + (b & 0xF)); _Operator.Source = x86Operand.NewDisplacement(value + 2); return _Operator; }
private x86Operator Read_4x(byte b) { x86Operator _Operator = null; _Operator = new x86Operator(b < 0x48 ? Intelx86Opcode.Inc : Intelx86Opcode.Dec); _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax + (b & 0x7)); return _Operator; }
private x86Operator Read_Segment(Intelx86Register segment) { x86Operator _Operator; _Operator = Read(); if (_Operator.OperandCount >= 1 && (_Operator.Source.Type == OperandType.Address || _Operator.Source.Type == OperandType.Memory || _Operator.Source.Type == OperandType.MemoryFull || _Operator.Source.Type == OperandType.MemoryOffset || _Operator.Source.Type == OperandType.MemoryScale)) _Operator.SegmentSrc = segment; else if (_Operator.OperandCount >= 2 && (_Operator.Destination.Type == OperandType.Address || _Operator.Destination.Type == OperandType.Memory || _Operator.Destination.Type == OperandType.MemoryFull || _Operator.Destination.Type == OperandType.MemoryOffset || _Operator.Destination.Type == OperandType.MemoryScale)) _Operator.Segment = segment; else { _Operator = new x86Operator(Intelx86Opcode.Segment); _Operator.Segment = segment; Length = 1; } //byte c = Buffer[X]; //if ((c & 7) >= 4) //{ // _Operator = new x86Operator(Intelx86Opcode.Segment); // _Operator.Segment = segment; //} //else //{ // _Operator = Read(); // if ((c & 0x2) == 0) // _Operator.Segment = segment; // else // _Operator.SegmentSrc = segment; //} return _Operator; }
private x86Operator Read_00_to_40(byte b) { x86Operator _Operator = null; long value; if ((b & 0x7) < 6) { _Operator = new x86Operator(Intelx86Opcode.Add + (b >> 3)); switch (b & 0x7) { case 0: b = Buffer[X]; Length++; _Operator.Destination = extractEb(b); _Operator.Source = extractGb(b); break; case 1: b = Buffer[X]; Length++; _Operator.Destination = extractEv(b); _Operator.Source = extractGv(b); break; case 2: b = Buffer[X]; Length++; _Operator.Destination = extractGb(b); _Operator.Source = extractEb(b); break; case 3: b = Buffer[X]; Length++; _Operator.Destination = extractGv(b); _Operator.Source = extractEv(b); break; case 4: value = (byte)Buffer[X]; Length++; _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al); _Operator.Source = x86Operand.NewValue(value); break; case 5: value = Buffer[X]; value |= (uint)Buffer[X + 1] << 8; value |= (uint)Buffer[X + 2] << 16; value |= (uint)Buffer[X + 3] << 24; Length += 4; _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax); _Operator.Source = x86Operand.NewValue(value); break; } } else if (b < 0x20) { if (b == 0x0F) { return Read_0F(); } _Operator = new x86Operator((b & 1) == 0 ? Intelx86Opcode.Push : Intelx86Opcode.Pop); _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Es + (b >> 3)); } else if (b < 0x40) { if (b == 0x26) { _Operator = Read_Segment(Intelx86Register.Es); } else if (b == 0x27) { _Operator = new x86Operator(Intelx86Opcode.Daa); } else if (b == 0x2E) { _Operator = Read_Segment(Intelx86Register.Cs); } else if (b == 0x2F) { _Operator = new x86Operator(Intelx86Opcode.Das); } else if (b == 0x36) { _Operator = Read_Segment(Intelx86Register.Ss); } else if (b == 0x37) { _Operator = new x86Operator(Intelx86Opcode.Aaa); } else if (b == 0x3E) { _Operator = Read_Segment(Intelx86Register.Ds); } else if (b == 0x3F) { _Operator = new x86Operator(Intelx86Opcode.Aas); } } else throw new ArgumentException(); return _Operator; }
private x86Operator Read_Fx(byte b) { x86Operator _Operator = null; if (b == 0xF0) { _Operator = Read(); _Operator.Prefix = "lock"; } else if (b == 0xF1) { _Operator = new x86Operator(Intelx86Opcode.Icebp); } else if (b == 0xF2) { _Operator = Read(); _Operator.Prefix = "repnz"; } else if (b == 0xF3) { _Operator = Read(); _Operator.Prefix = "repz"; } else if (b == 0xF4) { _Operator = new x86Operator(Intelx86Opcode.Hlt); } else if (b == 0xF5) { _Operator = new x86Operator(Intelx86Opcode.Cmc); } else if (b == 0xF6) { b = Buffer[X]; if (b == 0x8) { _Operator = new x86Operator(Intelx86Opcode.Bad); return _Operator; } _Operator = new x86Operator(Intelx86Opcode.Test, OperatorSize.Byte); Length++; _Operator.Destination = extractEb(b); _Operator.Source = extractLb(); } else if (b == 0xF7) { b = Buffer[X]; if (b == 0x8) { _Operator = new x86Operator(Intelx86Opcode.Bad); return _Operator; } _Operator = new x86Operator(Intelx86Opcode.Test, OperatorSize.DWord); Length++; _Operator.Destination = extractEv(b); _Operator.Source = extractLz(); } else if (b < 0xFE) _Operator = new x86Operator(Intelx86Opcode.Clc + b - 0xF8); else if (b == 0xFE) { b = Buffer[X]; if (((b >> 3) & 0x7) > 1) { _Operator = new x86Operator(Intelx86Opcode.Bad); return _Operator; } _Operator = new x86Operator(Intelx86Opcode.Inc + ((b >> 3) & 0x1), OperatorSize.Byte); Length++; _Operator.Source = extractEb(b); } else if (b == 0xFF) { b = Buffer[X]; int v = ((b >> 3) & 0x7); if (v == 7) { _Operator = new x86Operator(Intelx86Opcode.Bad); } else { Length++; switch (v) { case 0: _Operator = new x86Operator(Intelx86Opcode.Inc, OperatorSize.DWord); _Operator.Source = extractEv(b); break; case 1: _Operator = new x86Operator(Intelx86Opcode.Dec, OperatorSize.DWord); _Operator.Source = extractEv(b); break; case 2: _Operator = new x86Operator(Intelx86Opcode.Call); _Operator.Source = extractEv(b); break; case 3: _Operator = new x86Operator(Intelx86Opcode.Call); _Operator.Source = extractEv(b); break; case 4: _Operator = new x86Operator(Intelx86Opcode.Jmp); _Operator.Source = extractEv(b); break; case 5: _Operator = new x86Operator(Intelx86Opcode.Jmp); _Operator.Source = extractMa(b); break; case 6: _Operator = new x86Operator(Intelx86Opcode.Push, OperatorSize.DWord); _Operator.Source = extractEv(b); break; } } } else { } return _Operator; }
private x86Operator Read_Ex(byte b) { x86Operator _Operator = null; if (b == 0xE8) { _Operator = new x86Operator(Intelx86Opcode.Call); _Operator.Source = extractLz(); } else if (b == 0xE9) { _Operator = new x86Operator(Intelx86Opcode.Jmp); _Operator.Source = extractLz(); } else if (b == 0xEB) { _Operator = new x86Operator(Intelx86Opcode.Jmp); _Operator.Source = extractLb(); } else { } return _Operator; }
private x86Operator Read_Dx(byte b) { x86Operator _Operator = null; if (b == 0xD0) { b = Buffer[X]; int v = ((b >> 3) & 0x7); if (v == 6) { _Operator = new x86Operator(Intelx86Opcode.Bad); } else { switch (v) { case 0: _Operator = new x86Operator(Intelx86Opcode.Rol_, OperatorSize.Byte); break; case 1: _Operator = new x86Operator(Intelx86Opcode.Ror_, OperatorSize.Byte); break; case 2: _Operator = new x86Operator(Intelx86Opcode.Rcl_, OperatorSize.Byte); break; case 3: _Operator = new x86Operator(Intelx86Opcode.Rcr_, OperatorSize.Byte); break; case 4: _Operator = new x86Operator(Intelx86Opcode.Shl_, OperatorSize.Byte); break; case 5: _Operator = new x86Operator(Intelx86Opcode.Shr_, OperatorSize.Byte); break; case 7: _Operator = new x86Operator(Intelx86Opcode.Sar_, OperatorSize.Byte); break; } Length++; _Operator.Source = extractEb(b); } } else if (b == 0xD1) { b = Buffer[X]; int v = ((b >> 3) & 0x7); if (v == 6) { _Operator = new x86Operator(Intelx86Opcode.Bad); } else { switch (v) { case 0: _Operator = new x86Operator(Intelx86Opcode.Rol_, OperatorSize.DWord); break; case 1: _Operator = new x86Operator(Intelx86Opcode.Ror_, OperatorSize.DWord); break; case 2: _Operator = new x86Operator(Intelx86Opcode.Rcl_, OperatorSize.DWord); break; case 3: _Operator = new x86Operator(Intelx86Opcode.Rcr_, OperatorSize.DWord); break; case 4: _Operator = new x86Operator(Intelx86Opcode.Shl_, OperatorSize.DWord); break; case 5: _Operator = new x86Operator(Intelx86Opcode.Shr_, OperatorSize.DWord); break; case 7: _Operator = new x86Operator(Intelx86Opcode.Sar_, OperatorSize.DWord); break; } Length++; _Operator.Source = extractEv(b); } } else { } return _Operator; }
private x86Operator Read_Cx(byte b) { x86Operator _Operator = null; if (b == 0xC0) { b = Buffer[X]; int v = ((b >> 3) & 0x7); if (v == 6) { _Operator = new x86Operator(Intelx86Opcode.Bad); } else { switch (v) { case 0: _Operator = new x86Operator(Intelx86Opcode.Rol, OperatorSize.Byte); break; case 1: _Operator = new x86Operator(Intelx86Opcode.Ror, OperatorSize.Byte); break; case 2: _Operator = new x86Operator(Intelx86Opcode.Rcl, OperatorSize.Byte); break; case 3: _Operator = new x86Operator(Intelx86Opcode.Rcr, OperatorSize.Byte); break; case 4: _Operator = new x86Operator(Intelx86Opcode.Shl, OperatorSize.Byte); break; case 5: _Operator = new x86Operator(Intelx86Opcode.Shr, OperatorSize.Byte); break; case 7: _Operator = new x86Operator(Intelx86Opcode.Sar, OperatorSize.Byte); break; } Length++; _Operator.Destination = extractEb(b); _Operator.Source = extractLb(); } } else if (b == 0xC1) { b = Buffer[X]; int v = ((b >> 3) & 0x7); if (v == 6) { _Operator = new x86Operator(Intelx86Opcode.Bad); } else { switch (v) { case 0: _Operator = new x86Operator(Intelx86Opcode.Rol, OperatorSize.DWord); break; case 1: _Operator = new x86Operator(Intelx86Opcode.Ror, OperatorSize.DWord); break; case 2: _Operator = new x86Operator(Intelx86Opcode.Rcl, OperatorSize.DWord); break; case 3: _Operator = new x86Operator(Intelx86Opcode.Rcr, OperatorSize.DWord); break; case 4: _Operator = new x86Operator(Intelx86Opcode.Shl, OperatorSize.DWord); break; case 5: _Operator = new x86Operator(Intelx86Opcode.Shr, OperatorSize.DWord); break; case 7: _Operator = new x86Operator(Intelx86Opcode.Sar, OperatorSize.DWord); break; } Length++; _Operator.Destination = extractEv(b); _Operator.Source = extractLb(); } } else if (b == 0xC2) { long value = Buffer[X] | (Buffer[X + 1] << 8); Length += 2; _Operator = new x86Operator(Intelx86Opcode.Ret_); _Operator.Source = x86Operand.NewValue(value); } else if (b == 0xC3) { _Operator = new x86Operator(Intelx86Opcode.Ret); } else if (b == 0xC4) { _Operator = new x86Operator(Intelx86Opcode.Ret); } else if (b == 0xC6) { b = Buffer[X]; int v = ((b >> 3) & 0x7); if (v != 0) { _Operator = new x86Operator(Intelx86Opcode.Bad); } else { _Operator = new x86Operator(Intelx86Opcode.Mov, OperatorSize.Byte); Length++; _Operator.Destination = extractEb(b); _Operator.Source = extractLb(); } } else if (b == 0xC7) { b = Buffer[X]; int v = ((b >> 3) & 0x7); if (v != 0) { _Operator = new x86Operator(Intelx86Opcode.Bad); } else { _Operator = new x86Operator(Intelx86Opcode.Mov, OperatorSize.DWord); Length++; _Operator.Destination = extractEv(b); _Operator.Source = extractLz(); } } else if (b == 0xC8) { long valueB = Buffer[X]; Length++; long valueW = Buffer[X] | (Buffer[X + 1] << 8); Length += 2; _Operator = new x86Operator(Intelx86Opcode.Enter); _Operator.Source = x86Operand.NewValue(valueB); _Operator.Destination = x86Operand.NewValue(valueW); } else if (b == 0xC9) { _Operator = new x86Operator(Intelx86Opcode.Leave); } else if (b == 0xCA) { long value = Buffer[X] | (Buffer[X + 1] << 8); Length += 2; _Operator = new x86Operator(Intelx86Opcode.LRet_); _Operator.Source = x86Operand.NewValue(value); } else if (b == 0xCB) { _Operator = new x86Operator(Intelx86Opcode.LRet); } else if (b == 0xCC) { _Operator = new x86Operator(Intelx86Opcode.Int3); } else if (b == 0xCD) { _Operator = new x86Operator(Intelx86Opcode.Int); _Operator.Source = extractLb(); } else if (b < 0xD0) { } else { throw new ArgumentException(); } return _Operator; }
private x86Operator Read_Bx(byte b) { x86Operator _Operator = null; _Operator = new x86Operator(Intelx86Opcode.Mov); if (b < 0xB8) { _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al + (b & 7)); _Operator.Source = extractLb(); } else { _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax + (b & 7)); _Operator.Source = extractLz(); } return _Operator; }