Exemple #1
0
        private x86Operator Read_9x(byte b)
        {
            x86Operator _Operator = null;

              if (b == 0x90 && Length == 1) {
            _Operator = new x86Operator(Intelx86Opcode.Nop);
              } else if (b < 0x98) {
            _Operator = new x86Operator(Intelx86Opcode.Xchg);
            _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax);
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax + b - 0x90);
              } else if (b < 0x9A) {
            _Operator = new x86Operator(Intelx86Opcode.Cwtl + b - 0x98);
              } else if (b == 0x9A) {
            _Operator = new x86Operator(Intelx86Opcode.LCall);
            _Operator.Destination = extractLw();
            _Operator.Source = extractLz();
              } else if (b == 0x9B) {
            _Operator = new x86Operator(Intelx86Opcode.FWait);
              } else if (b < 0xA0) {
            _Operator = new x86Operator(Intelx86Opcode.Pushf + b - 0x9C);
              } else {
            throw new ArgumentException();
              }

              return _Operator;
        }
Exemple #2
0
        private x86Operator Read_Ax(byte b)
        {
            x86Operator _Operator = null;

              if (b == 0xA0) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al);
            _Operator.Source = extractOb();
              } else if (b == 0xA1) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax);
            _Operator.Source = extractOz();
              } else if (b == 0xA2) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            _Operator.Destination = extractOb();
            _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Al);
              } else if (b == 0xA3) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            _Operator.Destination = extractOz();
            _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax);
              } else if (b == 0xA4) {
            _Operator = new x86Operator(Intelx86Opcode.Movs, OperatorSize.Byte);
            _Operator.Segment = Intelx86Register.Es;
            _Operator.SegmentSrc = Intelx86Register.Ds;
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi);
              } else if (b == 0xA5) {
            _Operator = new x86Operator(Intelx86Opcode.Movs, OperatorSize.DWord);
            _Operator.Segment = Intelx86Register.Es;
            _Operator.SegmentSrc = Intelx86Register.Ds;
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi);
              } else if (b == 0xA6) {
            _Operator = new x86Operator(Intelx86Opcode.Cmps, OperatorSize.Byte);
            _Operator.Segment = Intelx86Register.Ds;
            _Operator.SegmentSrc = Intelx86Register.Es;
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Esi);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Edi);
              } else if (b == 0xA7) {
            _Operator = new x86Operator(Intelx86Opcode.Cmps, OperatorSize.DWord);
            _Operator.Segment = Intelx86Register.Ds;
            _Operator.SegmentSrc = Intelx86Register.Es;
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Esi);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Edi);
              } else if (b == 0xA8) {
            long value = Buffer[X];
            Length++;
            _Operator = new x86Operator(Intelx86Opcode.Test);
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al);
            _Operator.Source = x86Operand.NewValue(value);
              } else if (b == 0xA9) {
            long value = Buffer[X];
            value |= (uint)Buffer[X + 1] << 8;
            value |= (uint)Buffer[X + 2] << 16;
            value |= (uint)Buffer[X + 3] << 24;
            Length += 4;
            _Operator = new x86Operator(Intelx86Opcode.Test);
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax);
            _Operator.Source = x86Operand.NewValue(value);
              } else if (b == 0xAA) {
            _Operator = new x86Operator(Intelx86Opcode.Stos);
            _Operator.Segment = Intelx86Register.Es;
            _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Al);
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi);
              } else if (b == 0xAB) {
            _Operator = new x86Operator(Intelx86Opcode.Stos);
            _Operator.Segment = Intelx86Register.Es;
            _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax);
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi);
              } else if (b == 0xAC) {
            _Operator = new x86Operator(Intelx86Opcode.Lods);
            _Operator.SegmentSrc = Intelx86Register.Ds;
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi);
              } else if (b == 0xAD) {
            _Operator = new x86Operator(Intelx86Opcode.Lods);
            _Operator.SegmentSrc = Intelx86Register.Ds;
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi);
              } else if (b == 0xAE) {
            _Operator = new x86Operator(Intelx86Opcode.Scas);
            _Operator.SegmentSrc = Intelx86Register.Es;
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Edi);
              } else if (b == 0xAF) {
            _Operator = new x86Operator(Intelx86Opcode.Scas);
            _Operator.SegmentSrc = Intelx86Register.Es;
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Edi);
              } else {
            throw new ArgumentException();
              }

              return _Operator;
        }
Exemple #3
0
 private x86Operator Read_7x(byte b)
 {
     x86Operator _Operator = null;
       long value;
       value = (byte)Buffer[X];
       if (value >= 0xfe) {
     value -= 256;
       }
       if (value >= 0x80) {
     value |= 0xffffff00;
       }
       Length++;
       _Operator = new x86Operator(Intelx86Opcode.Jo + (b & 0xF));
       _Operator.Source = x86Operand.NewDisplacement(value + 2);
       return _Operator;
 }
Exemple #4
0
        private x86Operator Read_8x(byte b)
        {
            x86Operator _Operator = null;
              long value;

              if (b == 0x80) {
            b = Buffer[X];
            Length++;
            int reg = (b >> 3) & 0x7;
            _Operator = new x86Operator(Intelx86Opcode.Add + reg, OperatorSize.Byte);
            _Operator.Destination = extractEb(b);
            value = (byte)Buffer[X];
            Length++;
            _Operator.Source = x86Operand.NewValue(value);
              } else if (b == 0x81) {
            b = Buffer[X];
            Length++;
            int reg = (b >> 3) & 0x7;
            _Operator = new x86Operator(Intelx86Opcode.Add + reg, OperatorSize.DWord);
            _Operator.Destination = extractEv(b);
            _Operator.Source = extractLz();
              } else if (b == 0x82) {
            b = Buffer[X];
            Length++;
            int reg = (b >> 3) & 0x7;
            _Operator = new x86Operator(Intelx86Opcode.Add + reg, OperatorSize.Byte);
            _Operator.Destination = extractEb(b);
            _Operator.Source = extractLb();
              } else if (b == 0x83) {
            b = Buffer[X];
            Length++;
            int reg = (b >> 3) & 0x7;
            _Operator = new x86Operator(Intelx86Opcode.Add + reg, OperatorSize.DWord);
            _Operator.Destination = extractEv(b);
            _Operator.Source = extractLb();
              } else if (b < 0x88) {
            _Operator = new x86Operator(b < 0x86 ? Intelx86Opcode.Test : Intelx86Opcode.Xchg);
            if ((b & 1) == 0) {
              b = Buffer[X];
              Length++;
              _Operator.Source = extractGb(b);
              _Operator.Destination = extractEb(b);
            } else {
              b = Buffer[X];
              Length++;
              _Operator.Source = extractGv(b);
              _Operator.Destination = extractEv(b);
            }
              } else if (b == 0x88) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            b = Buffer[X];
            Length++;
            _Operator.Source = extractGb(b);
            _Operator.Destination = extractEb(b);
              } else if (b == 0x89) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            b = Buffer[X];
            Length++;
            _Operator.Source = extractGv(b);
            _Operator.Destination = extractEv(b);
              } else if (b == 0x8A) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            b = Buffer[X];
            Length++;
            _Operator.Source = extractEb(b);
            _Operator.Destination = extractGb(b);
              } else if (b == 0x8B) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            b = Buffer[X];
            Length++;
            _Operator.Source = extractEv(b);
            _Operator.Destination = extractGv(b);
              } else if (b == 0x8C) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            b = Buffer[X];
            Length++;
            _Operator.Source = extractSw(b);
            _Operator.Destination = extractEv(b);
              } else if (b == 0x8D) {
            _Operator = new x86Operator(Intelx86Opcode.Lea);
            b = Buffer[X];
            Length++;
            _Operator.Source = extractMa(b);
            _Operator.Destination = extractGv(b);
              } else if (b == 0x8E) {
            _Operator = new x86Operator(Intelx86Opcode.Mov);
            b = Buffer[X];
            Length++;
            _Operator.Destination = extractSw(b);
            _Operator.Source = extractEw(b);
              } else if (b == 0x8F) {
            b = Buffer[X];
            Length++;
            int reg = (b >> 3) & 0x7;
            if (reg == 0) {
              _Operator = new x86Operator(Intelx86Opcode.Pop, OperatorSize.DWord);
              _Operator.Source = extractEv(b);
            } else {
              _Operator = new x86Operator(Intelx86Opcode.Bad);
            }
              } else
            throw new ArgumentException();
              return _Operator;
        }
Exemple #5
0
 private x86Operator Read_5x(byte b)
 {
     x86Operator _Operator = null;
       _Operator = new x86Operator(b < 0x58 ? Intelx86Opcode.Push : Intelx86Opcode.Pop);
       _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax + (b & 0x7));
       return _Operator;
 }
Exemple #6
0
        private x86Operator Read_6x(byte b)
        {
            x86Operator _Operator = null;

              if (b == 0x60) {
            _Operator = new x86Operator(Intelx86Opcode.Pusha);
              } else if (b == 0x61) {
            _Operator = new x86Operator(Intelx86Opcode.Popa);
              } else if (b == 0x62) {
            _Operator = new x86Operator(Intelx86Opcode.Bound);
            b = Buffer[X];
            Length++;
            _Operator.Destination = extractMa(b);
            _Operator.Source = extractGv(b);
            if (_Operator.Destination == null) {
              Length--;
              _Operator = new x86Operator(Intelx86Opcode.Bad);
            }
              } else if (b == 0x63) {
            _Operator = new x86Operator(Intelx86Opcode.Arpl);
            b = Buffer[X];
            Length++;
            _Operator.Destination = extractEw(b);
            _Operator.Source = extractGw(b);
              } else if (b == 0x64) {
            _Operator = Read_Segment(Intelx86Register.Fs);
              } else if (b == 0x65) {
            _Operator = Read_Segment(Intelx86Register.Gs);

              } else if (b == 0x66) {
            _Operator = Read();

            if (_Operator.Destination.Register >= (int)Intelx86Register.Eax &&
            _Operator.Destination.Register <= (int)Intelx86Register.Edi) {
              _Operator.Destination.Register -= 8;
            }

            if (_Operator.Source.Register >= (int)Intelx86Register.Eax &&
            _Operator.Source.Register <= (int)Intelx86Register.Edi) {
              _Operator.Source.Register -= 8;
            }
              } else if (b == 0x68) {
            _Operator = new x86Operator(Intelx86Opcode.Push);
            _Operator.Source = extractLz();
              } else if (b == 0x69) {
            _Operator = new x86Operator(Intelx86Opcode.IMul);
            b = Buffer[X];
            Length++;
            _Operator.ThirdOpad = extractGv(b);
            _Operator.Destination = extractEv(b);
            _Operator.Source = extractLz();

              } else if (b == 0x6a) {
            _Operator = new x86Operator(Intelx86Opcode.Push);
            _Operator.Source = extractLb();
              } else if (b == 0x6b) {
            _Operator = new x86Operator(Intelx86Opcode.IMul);
            b = Buffer[X];
            Length++;
            _Operator.ThirdOpad = extractGv(b);
            _Operator.Destination = extractEv(b);
            _Operator.Source = extractLb();

              } else if (b == 0x6c) {
            _Operator = new x86Operator(Intelx86Opcode.Ins, OperatorSize.Byte);
            _Operator.Segment = Intelx86Register.Es;
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Dx);
              } else if (b == 0x6d) {
            _Operator = new x86Operator(Intelx86Opcode.Ins, OperatorSize.DWord);
            _Operator.Segment = Intelx86Register.Es;
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Edi);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Dx);
              } else if (b == 0x6e) {
            _Operator = new x86Operator(Intelx86Opcode.Outs, OperatorSize.Byte);
            _Operator.SegmentSrc = Intelx86Register.Ds;
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Dx);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi);
              } else if (b == 0x6f) {
            _Operator = new x86Operator(Intelx86Opcode.Outs, OperatorSize.DWord);
            _Operator.SegmentSrc = Intelx86Register.Ds;
            _Operator.Destination = x86Operand.NewMemory((int)Intelx86Register.Dx);
            _Operator.Source = x86Operand.NewMemory((int)Intelx86Register.Esi);
              } else {
            throw new ArgumentException();
              }

              return _Operator;
        }
Exemple #7
0
 private x86Operator Read_0F_8x(byte b)
 {
     x86Operator _Operator = null;
       long value;
       value = Buffer[X];
       value |= (uint)Buffer[X + 1] << 8;
       value |= (uint)Buffer[X + 2] << 16;
       value |= (uint)Buffer[X + 3] << 24;
       Length += 4;
       _Operator = new x86Operator(Intelx86Opcode.Jo + (b & 0xF));
       _Operator.Source = x86Operand.NewDisplacement(value + 2);
       return _Operator;
 }
Exemple #8
0
 private x86Operator Read_4x(byte b)
 {
     x86Operator _Operator = null;
       _Operator = new x86Operator(b < 0x48 ? Intelx86Opcode.Inc : Intelx86Opcode.Dec);
       _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Eax + (b & 0x7));
       return _Operator;
 }
Exemple #9
0
        private x86Operator Read_Segment(Intelx86Register segment)
        {
            x86Operator _Operator;
              _Operator = Read();

              if (_Operator.OperandCount >= 1 &&
              (_Operator.Source.Type == OperandType.Address ||
              _Operator.Source.Type == OperandType.Memory ||
              _Operator.Source.Type == OperandType.MemoryFull ||
              _Operator.Source.Type == OperandType.MemoryOffset ||
              _Operator.Source.Type == OperandType.MemoryScale))
            _Operator.SegmentSrc = segment;

              else if (_Operator.OperandCount >= 2 &&
              (_Operator.Destination.Type == OperandType.Address ||
              _Operator.Destination.Type == OperandType.Memory ||
              _Operator.Destination.Type == OperandType.MemoryFull ||
              _Operator.Destination.Type == OperandType.MemoryOffset ||
              _Operator.Destination.Type == OperandType.MemoryScale))
            _Operator.Segment = segment;

              else {
            _Operator = new x86Operator(Intelx86Opcode.Segment);
            _Operator.Segment = segment;
            Length = 1;
              }

              //byte c = Buffer[X];
              //if ((c & 7) >= 4)
              //{
              //    _Operator = new x86Operator(Intelx86Opcode.Segment);
              //    _Operator.Segment = segment;
              //}
              //else
              //{
              //    _Operator = Read();
              //    if ((c & 0x2) == 0)
              //        _Operator.Segment = segment;
              //    else
              //        _Operator.SegmentSrc = segment;
              //}
              return _Operator;
        }
Exemple #10
0
        private x86Operator Read_00_to_40(byte b)
        {
            x86Operator _Operator = null;
              long value;
              if ((b & 0x7) < 6) {
            _Operator = new x86Operator(Intelx86Opcode.Add + (b >> 3));
            switch (b & 0x7) {
              case 0:
            b = Buffer[X];
            Length++;
            _Operator.Destination = extractEb(b);
            _Operator.Source = extractGb(b);
            break;
              case 1:
            b = Buffer[X];
            Length++;
            _Operator.Destination = extractEv(b);
            _Operator.Source = extractGv(b);
            break;
              case 2:
            b = Buffer[X];
            Length++;
            _Operator.Destination = extractGb(b);
            _Operator.Source = extractEb(b);
            break;
              case 3:
            b = Buffer[X];
            Length++;
            _Operator.Destination = extractGv(b);
            _Operator.Source = extractEv(b);
            break;
              case 4:
            value = (byte)Buffer[X];
            Length++;
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al);
            _Operator.Source = x86Operand.NewValue(value);
            break;
              case 5:
            value = Buffer[X];
            value |= (uint)Buffer[X + 1] << 8;
            value |= (uint)Buffer[X + 2] << 16;
            value |= (uint)Buffer[X + 3] << 24;
            Length += 4;
            _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax);
            _Operator.Source = x86Operand.NewValue(value);
            break;
            }

              } else if (b < 0x20) {
            if (b == 0x0F) {
              return Read_0F();
            }

            _Operator = new x86Operator((b & 1) == 0 ? Intelx86Opcode.Push : Intelx86Opcode.Pop);
            _Operator.Source = x86Operand.NewRegister((int)Intelx86Register.Es + (b >> 3));
              } else if (b < 0x40) {
            if (b == 0x26) {
              _Operator = Read_Segment(Intelx86Register.Es);
            } else if (b == 0x27) {
              _Operator = new x86Operator(Intelx86Opcode.Daa);
            } else if (b == 0x2E) {
              _Operator = Read_Segment(Intelx86Register.Cs);
            } else if (b == 0x2F) {
              _Operator = new x86Operator(Intelx86Opcode.Das);
            } else if (b == 0x36) {
              _Operator = Read_Segment(Intelx86Register.Ss);
            } else if (b == 0x37) {
              _Operator = new x86Operator(Intelx86Opcode.Aaa);
            } else if (b == 0x3E) {
              _Operator = Read_Segment(Intelx86Register.Ds);
            } else if (b == 0x3F) {
              _Operator = new x86Operator(Intelx86Opcode.Aas);
            }
              } else
            throw new ArgumentException();
              return _Operator;
        }
Exemple #11
0
        private x86Operator Read_Fx(byte b)
        {
            x86Operator _Operator = null;
              if (b == 0xF0) {
            _Operator = Read();
            _Operator.Prefix = "lock";
              } else if (b == 0xF1) {
            _Operator = new x86Operator(Intelx86Opcode.Icebp);
              } else if (b == 0xF2) {
            _Operator = Read();
            _Operator.Prefix = "repnz";
              } else if (b == 0xF3) {
            _Operator = Read();
            _Operator.Prefix = "repz";
              } else if (b == 0xF4) {
            _Operator = new x86Operator(Intelx86Opcode.Hlt);
              } else if (b == 0xF5) {
            _Operator = new x86Operator(Intelx86Opcode.Cmc);
              } else if (b == 0xF6) {
            b = Buffer[X];
            if (b == 0x8) {
              _Operator = new x86Operator(Intelx86Opcode.Bad);
              return _Operator;
            }
            _Operator = new x86Operator(Intelx86Opcode.Test, OperatorSize.Byte);
            Length++;
            _Operator.Destination = extractEb(b);
            _Operator.Source = extractLb();
              } else if (b == 0xF7) {
            b = Buffer[X];
            if (b == 0x8) {
              _Operator = new x86Operator(Intelx86Opcode.Bad);
              return _Operator;
            }
            _Operator = new x86Operator(Intelx86Opcode.Test, OperatorSize.DWord);
            Length++;
            _Operator.Destination = extractEv(b);
            _Operator.Source = extractLz();

              } else if (b < 0xFE)
            _Operator = new x86Operator(Intelx86Opcode.Clc + b - 0xF8);
              else if (b == 0xFE) {
            b = Buffer[X];
            if (((b >> 3) & 0x7) > 1) {
              _Operator = new x86Operator(Intelx86Opcode.Bad);
              return _Operator;
            }
            _Operator = new x86Operator(Intelx86Opcode.Inc + ((b >> 3) & 0x1), OperatorSize.Byte);
            Length++;
            _Operator.Source = extractEb(b);
              } else if (b == 0xFF) {
            b = Buffer[X];
            int v = ((b >> 3) & 0x7);
            if (v == 7) {
              _Operator = new x86Operator(Intelx86Opcode.Bad);
            } else {
              Length++;
              switch (v) {
            case 0:
              _Operator = new x86Operator(Intelx86Opcode.Inc, OperatorSize.DWord);
              _Operator.Source = extractEv(b);
              break;
            case 1:
              _Operator = new x86Operator(Intelx86Opcode.Dec, OperatorSize.DWord);
              _Operator.Source = extractEv(b);
              break;
            case 2:
              _Operator = new x86Operator(Intelx86Opcode.Call);
              _Operator.Source = extractEv(b);
              break;
            case 3:
              _Operator = new x86Operator(Intelx86Opcode.Call);
              _Operator.Source = extractEv(b);
              break;
            case 4:
              _Operator = new x86Operator(Intelx86Opcode.Jmp);
              _Operator.Source = extractEv(b);
              break;
            case 5:
              _Operator = new x86Operator(Intelx86Opcode.Jmp);
              _Operator.Source = extractMa(b);
              break;
            case 6:
              _Operator = new x86Operator(Intelx86Opcode.Push, OperatorSize.DWord);
              _Operator.Source = extractEv(b);
              break;
              }
            }
              } else {
              }
              return _Operator;
        }
Exemple #12
0
 private x86Operator Read_Ex(byte b)
 {
     x86Operator _Operator = null;
       if (b == 0xE8) {
     _Operator = new x86Operator(Intelx86Opcode.Call);
     _Operator.Source = extractLz();
       } else if (b == 0xE9) {
     _Operator = new x86Operator(Intelx86Opcode.Jmp);
     _Operator.Source = extractLz();
       } else if (b == 0xEB) {
     _Operator = new x86Operator(Intelx86Opcode.Jmp);
     _Operator.Source = extractLb();
       } else {
       }
       return _Operator;
 }
Exemple #13
0
 private x86Operator Read_Dx(byte b)
 {
     x86Operator _Operator = null;
       if (b == 0xD0) {
     b = Buffer[X];
     int v = ((b >> 3) & 0x7);
     if (v == 6) {
       _Operator = new x86Operator(Intelx86Opcode.Bad);
     } else {
       switch (v) {
     case 0:
       _Operator = new x86Operator(Intelx86Opcode.Rol_, OperatorSize.Byte);
       break;
     case 1:
       _Operator = new x86Operator(Intelx86Opcode.Ror_, OperatorSize.Byte);
       break;
     case 2:
       _Operator = new x86Operator(Intelx86Opcode.Rcl_, OperatorSize.Byte);
       break;
     case 3:
       _Operator = new x86Operator(Intelx86Opcode.Rcr_, OperatorSize.Byte);
       break;
     case 4:
       _Operator = new x86Operator(Intelx86Opcode.Shl_, OperatorSize.Byte);
       break;
     case 5:
       _Operator = new x86Operator(Intelx86Opcode.Shr_, OperatorSize.Byte);
       break;
     case 7:
       _Operator = new x86Operator(Intelx86Opcode.Sar_, OperatorSize.Byte);
       break;
       }
       Length++;
       _Operator.Source = extractEb(b);
     }
       } else if (b == 0xD1) {
     b = Buffer[X];
     int v = ((b >> 3) & 0x7);
     if (v == 6) {
       _Operator = new x86Operator(Intelx86Opcode.Bad);
     } else {
       switch (v) {
     case 0:
       _Operator = new x86Operator(Intelx86Opcode.Rol_, OperatorSize.DWord);
       break;
     case 1:
       _Operator = new x86Operator(Intelx86Opcode.Ror_, OperatorSize.DWord);
       break;
     case 2:
       _Operator = new x86Operator(Intelx86Opcode.Rcl_, OperatorSize.DWord);
       break;
     case 3:
       _Operator = new x86Operator(Intelx86Opcode.Rcr_, OperatorSize.DWord);
       break;
     case 4:
       _Operator = new x86Operator(Intelx86Opcode.Shl_, OperatorSize.DWord);
       break;
     case 5:
       _Operator = new x86Operator(Intelx86Opcode.Shr_, OperatorSize.DWord);
       break;
     case 7:
       _Operator = new x86Operator(Intelx86Opcode.Sar_, OperatorSize.DWord);
       break;
       }
       Length++;
       _Operator.Source = extractEv(b);
     }
       } else {
       }
       return _Operator;
 }
Exemple #14
0
        private x86Operator Read_Cx(byte b)
        {
            x86Operator _Operator = null;

              if (b == 0xC0) {
            b = Buffer[X];
            int v = ((b >> 3) & 0x7);
            if (v == 6) {
              _Operator = new x86Operator(Intelx86Opcode.Bad);
            } else {
              switch (v) {
            case 0:
              _Operator = new x86Operator(Intelx86Opcode.Rol, OperatorSize.Byte);
              break;
            case 1:
              _Operator = new x86Operator(Intelx86Opcode.Ror, OperatorSize.Byte);
              break;
            case 2:
              _Operator = new x86Operator(Intelx86Opcode.Rcl, OperatorSize.Byte);
              break;
            case 3:
              _Operator = new x86Operator(Intelx86Opcode.Rcr, OperatorSize.Byte);
              break;
            case 4:
              _Operator = new x86Operator(Intelx86Opcode.Shl, OperatorSize.Byte);
              break;
            case 5:
              _Operator = new x86Operator(Intelx86Opcode.Shr, OperatorSize.Byte);
              break;
            case 7:
              _Operator = new x86Operator(Intelx86Opcode.Sar, OperatorSize.Byte);
              break;
              }
              Length++;
              _Operator.Destination = extractEb(b);
              _Operator.Source = extractLb();
            }
              } else if (b == 0xC1) {
            b = Buffer[X];
            int v = ((b >> 3) & 0x7);
            if (v == 6) {
              _Operator = new x86Operator(Intelx86Opcode.Bad);
            } else {
              switch (v) {
            case 0:
              _Operator = new x86Operator(Intelx86Opcode.Rol, OperatorSize.DWord);
              break;
            case 1:
              _Operator = new x86Operator(Intelx86Opcode.Ror, OperatorSize.DWord);
              break;
            case 2:
              _Operator = new x86Operator(Intelx86Opcode.Rcl, OperatorSize.DWord);
              break;
            case 3:
              _Operator = new x86Operator(Intelx86Opcode.Rcr, OperatorSize.DWord);
              break;
            case 4:
              _Operator = new x86Operator(Intelx86Opcode.Shl, OperatorSize.DWord);
              break;
            case 5:
              _Operator = new x86Operator(Intelx86Opcode.Shr, OperatorSize.DWord);
              break;
            case 7:
              _Operator = new x86Operator(Intelx86Opcode.Sar, OperatorSize.DWord);
              break;
              }
              Length++;
              _Operator.Destination = extractEv(b);
              _Operator.Source = extractLb();
            }
              } else if (b == 0xC2) {
            long value = Buffer[X] | (Buffer[X + 1] << 8);
            Length += 2;
            _Operator = new x86Operator(Intelx86Opcode.Ret_);
            _Operator.Source = x86Operand.NewValue(value);
              } else if (b == 0xC3) {
            _Operator = new x86Operator(Intelx86Opcode.Ret);
              } else if (b == 0xC4) {
            _Operator = new x86Operator(Intelx86Opcode.Ret);
              } else if (b == 0xC6) {
            b = Buffer[X];
            int v = ((b >> 3) & 0x7);
            if (v != 0) {
              _Operator = new x86Operator(Intelx86Opcode.Bad);
            } else {
              _Operator = new x86Operator(Intelx86Opcode.Mov, OperatorSize.Byte);
              Length++;
              _Operator.Destination = extractEb(b);
              _Operator.Source = extractLb();
            }
              } else if (b == 0xC7) {
            b = Buffer[X];
            int v = ((b >> 3) & 0x7);
            if (v != 0) {
              _Operator = new x86Operator(Intelx86Opcode.Bad);
            } else {
              _Operator = new x86Operator(Intelx86Opcode.Mov, OperatorSize.DWord);
              Length++;
              _Operator.Destination = extractEv(b);
              _Operator.Source = extractLz();
            }
              } else if (b == 0xC8) {
            long valueB = Buffer[X];
            Length++;
            long valueW = Buffer[X] | (Buffer[X + 1] << 8);
            Length += 2;
            _Operator = new x86Operator(Intelx86Opcode.Enter);
            _Operator.Source = x86Operand.NewValue(valueB);
            _Operator.Destination = x86Operand.NewValue(valueW);
              } else if (b == 0xC9) {
            _Operator = new x86Operator(Intelx86Opcode.Leave);
              } else if (b == 0xCA) {
            long value = Buffer[X] | (Buffer[X + 1] << 8);
            Length += 2;
            _Operator = new x86Operator(Intelx86Opcode.LRet_);
            _Operator.Source = x86Operand.NewValue(value);
              } else if (b == 0xCB) {
            _Operator = new x86Operator(Intelx86Opcode.LRet);
              } else if (b == 0xCC) {
            _Operator = new x86Operator(Intelx86Opcode.Int3);
              } else if (b == 0xCD) {
            _Operator = new x86Operator(Intelx86Opcode.Int);
            _Operator.Source = extractLb();
              } else if (b < 0xD0) {
              } else {
            throw new ArgumentException();
              }

              return _Operator;
        }
Exemple #15
0
 private x86Operator Read_Bx(byte b)
 {
     x86Operator _Operator = null;
       _Operator = new x86Operator(Intelx86Opcode.Mov);
       if (b < 0xB8) {
     _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Al + (b & 7));
     _Operator.Source = extractLb();
       } else {
     _Operator.Destination = x86Operand.NewRegister((int)Intelx86Register.Eax + (b & 7));
     _Operator.Source = extractLz();
       }
       return _Operator;
 }