1 /* disasm.c where all the _work_ gets done in the Netwide Disassembler
3 * The Netwide Assembler is copyright (C) 1996 Simon Tatham and
4 * Julian Hall. All rights reserved. The software is
5 * redistributable under the licence given in the file "Licence"
6 * distributed in the NASM archive.
8 * initial version 27/iii/95 by Simon Tatham
26 * Flags that go into the `segment' field of `insn' structures
29 #define SEG_RELATIVE 1
36 #define SEG_SIGNED 128
45 uint8_t osize; /* Operand size */
46 uint8_t asize; /* Address size */
47 uint8_t osp; /* Operand size prefix present */
48 uint8_t asp; /* Address size prefix present */
49 uint8_t rep; /* Rep prefix present */
50 uint8_t seg; /* Segment override prefix present */
51 uint8_t lock; /* Lock prefix present */
52 uint8_t rex; /* Rex prefix present */
55 #define getu8(x) (*(uint8_t *)(x))
56 #if defined(__i386__) || defined(__x86_64__)
57 /* Littleendian CPU which can handle unaligned references */
58 #define getu16(x) (*(uint16_t *)(x))
59 #define getu32(x) (*(uint32_t *)(x))
60 #define getu64(x) (*(uint64_t *)(x))
62 static uint16_t getu16(uint8_t *data)
64 return (uint16_t)data[0] + ((uint16_t)data[1] << 8);
66 static uint32_t getu32(uint8_t *data)
68 return (uint32_t)getu16(data) + ((uint32_t)getu16(data+2) << 16);
70 static uint64_t getu64(uint8_t *data)
72 return (uint64_t)getu32(data) + ((uint64_t)getu32(data+4) << 32);
76 #define gets8(x) ((int8_t)getu8(x))
77 #define gets16(x) ((int16_t)getu16(x))
78 #define gets32(x) ((int32_t)getu32(x))
79 #define gets64(x) ((int64_t)getu64(x))
81 /* Important: regval must already have been adjusted for rex extensions */
82 static enum reg_enum whichreg(int32_t regflags, int regval, int rex)
84 if (!(regflags & (REGISTER|REGMEM)))
85 return 0; /* Registers not permissible?! */
89 if (!(REG_AL & ~regflags))
91 if (!(REG_AX & ~regflags))
93 if (!(REG_EAX & ~regflags))
95 if (!(REG_RAX & ~regflags))
97 if (!(REG_DL & ~regflags))
99 if (!(REG_DX & ~regflags))
101 if (!(REG_EDX & ~regflags))
103 if (!(REG_RDX & ~regflags))
105 if (!(REG_CL & ~regflags))
107 if (!(REG_CX & ~regflags))
109 if (!(REG_ECX & ~regflags))
111 if (!(REG_RCX & ~regflags))
113 if (!(FPU0 & ~regflags))
115 if (!(REG_CS & ~regflags))
116 return (regval == 1) ? R_CS : 0;
117 if (!(REG_DESS & ~regflags))
118 return (regval == 0 || regval == 2
119 || regval == 3 ? rd_sreg[regval] : 0);
120 if (!(REG_FSGS & ~regflags))
121 return (regval == 4 || regval == 5 ? rd_sreg[regval] : 0);
122 if (!(REG_SEG67 & ~regflags))
123 return (regval == 6 || regval == 7 ? rd_sreg[regval] : 0);
125 /* All the entries below look up regval in an 16-entry array */
126 if (regval < 0 || regval > 15)
129 if (!(REG8 & ~regflags)) {
131 return rd_reg8_rex[regval];
133 return rd_reg8[regval];
135 if (!(REG16 & ~regflags))
136 return rd_reg16[regval];
137 if (!(REG32 & ~regflags))
138 return rd_reg32[regval];
139 if (!(REG64 & ~regflags))
140 return rd_reg64[regval];
141 if (!(REG_SREG & ~regflags))
142 return rd_sreg[regval & 7]; /* Ignore REX */
143 if (!(REG_CREG & ~regflags))
144 return rd_creg[regval];
145 if (!(REG_DREG & ~regflags))
146 return rd_dreg[regval];
147 if (!(REG_TREG & ~regflags)) {
149 return 0; /* TR registers are ill-defined with rex */
150 return rd_treg[regval];
152 if (!(FPUREG & ~regflags))
153 return rd_fpureg[regval & 7]; /* Ignore REX */
154 if (!(MMXREG & ~regflags))
155 return rd_mmxreg[regval & 7]; /* Ignore REX */
156 if (!(XMMREG & ~regflags))
157 return rd_xmmreg[regval];
162 static const char *whichcond(int condval)
164 static int conds[] = {
165 C_O, C_NO, C_C, C_NC, C_Z, C_NZ, C_NA, C_A,
166 C_S, C_NS, C_PE, C_PO, C_L, C_NL, C_NG, C_G
168 return conditions[conds[condval]];
172 * Process a DREX suffix
174 static uint8_t *do_drex(uint8_t *data, insn *ins)
176 uint8_t drex = *data++;
177 operand *dst = &ins->oprs[ins->drexdst];
179 if ((drex & 8) != ((ins->rex & REX_OC) ? 8 : 0))
180 return NULL; /* OC0 mismatch */
181 ins->rex = (ins->rex & ~7) | (drex & 7);
183 dst->segment = SEG_RMREG;
184 dst->basereg = drex >> 4;
190 * Process an effective address (ModRM) specification.
192 static uint8_t *do_ea(uint8_t *data, int modrm, int asize,
193 int segsize, operand * op, insn *ins)
195 int mod, rm, scale, index, base;
199 mod = (modrm >> 6) & 03;
202 if (mod != 3 && rm == 4 && asize != 16)
205 if (ins->rex & REX_D) {
206 data = do_drex(data, ins);
212 if (mod == 3) { /* pure register version */
213 op->basereg = rm+(rex & REX_B ? 8 : 0);
214 op->segment |= SEG_RMREG;
223 * <mod> specifies the displacement size (none, byte or
224 * word), and <rm> specifies the register combination.
225 * Exception: mod=0,rm=6 does not specify [BP] as one might
226 * expect, but instead specifies [disp16].
228 op->indexreg = op->basereg = -1;
229 op->scale = 1; /* always, in 16 bits */
260 if (rm == 6 && mod == 0) { /* special case */
264 mod = 2; /* fake disp16 */
268 op->segment |= SEG_NODISP;
271 op->segment |= SEG_DISP8;
272 op->offset = (int8_t)*data++;
275 op->segment |= SEG_DISP16;
276 op->offset = *data++;
277 op->offset |= ((unsigned)*data++) << 8;
283 * Once again, <mod> specifies displacement size (this time
284 * none, byte or *dword*), while <rm> specifies the base
285 * register. Again, [EBP] is missing, replaced by a pure
286 * disp32 (this time that's mod=0,rm=*5*) in 32-bit mode,
287 * and RIP-relative addressing in 64-bit mode.
290 * indicates not a single base register, but instead the
291 * presence of a SIB byte...
293 int a64 = asize == 64;
298 op->basereg = rd_reg64[rm | ((rex & REX_B) ? 8 : 0)];
300 op->basereg = rd_reg32[rm | ((rex & REX_B) ? 8 : 0)];
302 if (rm == 5 && mod == 0) {
304 op->eaflags |= EAF_REL;
305 op->segment |= SEG_RELATIVE;
306 mod = 2; /* fake disp32 */
310 op->disp_size = asize;
313 mod = 2; /* fake disp32 */
316 if (rm == 4) { /* process SIB */
317 scale = (sib >> 6) & 03;
318 index = (sib >> 3) & 07;
321 op->scale = 1 << scale;
324 op->indexreg = -1; /* ESP/RSP/R12 cannot be an index */
326 op->indexreg = rd_reg64[index | ((rex & REX_X) ? 8 : 0)];
328 op->indexreg = rd_reg64[index | ((rex & REX_X) ? 8 : 0)];
330 if (base == 5 && mod == 0) {
332 mod = 2; /* Fake disp32 */
334 op->basereg = rd_reg64[base | ((rex & REX_B) ? 8 : 0)];
336 op->basereg = rd_reg32[base | ((rex & REX_B) ? 8 : 0)];
344 op->segment |= SEG_NODISP;
347 op->segment |= SEG_DISP8;
348 op->offset = gets8(data);
352 op->segment |= SEG_DISP32;
353 op->offset = getu32(data);
362 * Determine whether the instruction template in t corresponds to the data
363 * stream in data. Return the number of bytes matched if so.
365 #define case4(x) case (x): case (x)+1: case (x)+2: case (x)+3
367 static int matches(const struct itemplate *t, uint8_t *data,
368 const struct prefix_info *prefix, int segsize, insn *ins)
370 uint8_t *r = (uint8_t *)(t->code);
371 uint8_t *origdata = data;
372 bool a_used = false, o_used = false;
373 enum prefixes drep = 0;
374 uint8_t lock = prefix->lock;
375 int osize = prefix->osize;
376 int asize = prefix->asize;
380 for (i = 0; i < MAX_OPERANDS; i++) {
381 ins->oprs[i].segment = ins->oprs[i].disp_size =
382 (segsize == 64 ? SEG_64BIT : segsize == 32 ? SEG_32BIT : 0);
385 ins->rex = prefix->rex;
386 memset(ins->prefixes, 0, sizeof ins->prefixes);
388 if (t->flags & (segsize == 64 ? IF_NOLONG : IF_LONG))
391 if (prefix->rep == 0xF2)
393 else if (prefix->rep == 0xF3)
396 while ((c = *r++) != 0) {
397 opx = &ins->oprs[c & 3];
411 ins->oprs[0].basereg = 0;
414 ins->oprs[0].basereg = 2;
417 ins->oprs[0].basereg = 3;
427 ins->oprs[0].basereg = 4;
430 ins->oprs[0].basereg = 5;
440 ins->oprs[0].basereg = 0;
443 ins->oprs[0].basereg = 1;
446 ins->oprs[0].basereg = 2;
449 ins->oprs[0].basereg = 3;
459 ins->oprs[0].basereg = 4;
462 ins->oprs[0].basereg = 5;
471 int t = *r++, d = *data++;
472 if (d < t || d > t + 7)
475 opx->basereg = (d-t)+
476 (ins->rex & REX_B ? 8 : 0);
477 opx->segment |= SEG_RMREG;
483 opx->offset = (int8_t)*data++;
484 opx->segment |= SEG_SIGNED;
488 opx->offset = *data++;
492 opx->offset = *data++;
496 opx->offset = getu16(data);
502 opx->offset = getu32(data);
505 opx->offset = getu16(data);
508 if (segsize != asize)
509 opx->disp_size = asize;
513 opx->offset = getu32(data);
520 opx->offset = getu16(data);
526 opx->offset = getu32(data);
532 opx->offset = getu64(data);
540 opx->offset = gets8(data++);
541 opx->segment |= SEG_RELATIVE;
545 opx->offset = getu64(data);
550 opx->offset = gets16(data);
552 opx->segment |= SEG_RELATIVE;
553 opx->segment &= ~SEG_32BIT;
557 opx->segment |= SEG_RELATIVE;
559 opx->offset = getu16(data);
561 opx->segment &= ~(SEG_32BIT|SEG_64BIT);
562 } else if (osize == 32) {
563 opx->offset = getu32(data);
565 opx->segment &= ~SEG_64BIT;
566 opx->segment |= SEG_32BIT;
568 if (segsize != osize) {
570 (opx->type & ~SIZE_MASK)
571 | ((osize == 16) ? BITS16 : BITS32);
576 opx->offset = getu32(data);
578 opx->segment |= SEG_32BIT | SEG_RELATIVE;
587 opx->segment |= SEG_RMREG;
588 data = do_ea(data, modrm, asize, segsize,
589 &ins->oprs[(c >> 3) & 3], ins);
592 opx->basereg = ((modrm >> 3)&7)+
593 (ins->rex & REX_R ? 8 : 0);
598 opx->offset = getu16(data);
603 opx->offset = getu32(data);
609 ins->drexdst = c & 3;
613 ins->rex |= REX_D|REX_OC;
614 ins->drexdst = c & 3;
623 data = do_drex(data, ins);
638 if (((modrm >> 3) & 07) != (c & 07))
639 return false; /* spare field doesn't match up */
640 data = do_ea(data, modrm, asize, segsize,
641 &ins->oprs[(c >> 3) & 07], ins);
662 if (asize != segsize)
676 if (prefix->rex & REX_B)
681 if (prefix->rex & REX_X)
686 if (prefix->rex & REX_R)
691 if (prefix->rex & REX_W)
710 if (osize != (segsize == 16) ? 16 : 32)
717 ins->rex |= REX_W; /* 64-bit only instruction */
723 if (!(ins->rex & (REX_P|REX_W)) || osize != 64)
730 int t = *r++, d = *data++;
731 if (d < t || d > t + 15)
734 ins->condition = d - t;
744 if (prefix->rep != 0xF2)
749 if (prefix->rep != 0xF3)
792 return false; /* Unknown code */
796 /* REX cannot be combined with DREX */
797 if ((ins->rex & REX_D) && (prefix->rex))
801 * Check for unused rep or a/o prefixes.
803 for (i = 0; i < t->operands; i++) {
804 if (ins->oprs[i].segment != SEG_RMREG)
809 if (ins->prefixes[PPS_LREP])
811 ins->prefixes[PPS_LREP] = P_LOCK;
814 if (ins->prefixes[PPS_LREP])
816 ins->prefixes[PPS_LREP] = drep;
819 if (osize != ((segsize == 16) ? 16 : 32)) {
820 enum prefixes pfx = 0;
834 if (ins->prefixes[PPS_OSIZE])
836 ins->prefixes[PPS_OSIZE] = pfx;
839 if (!a_used && asize != segsize) {
840 if (ins->prefixes[PPS_ASIZE])
842 ins->prefixes[PPS_ASIZE] = asize == 16 ? P_A16 : P_A32;
845 /* Fix: check for redundant REX prefixes */
847 return data - origdata;
850 int32_t disasm(uint8_t *data, char *output, int outbufsize, int segsize,
851 int32_t offset, int autosync, uint32_t prefer)
853 const struct itemplate * const *p, * const *best_p;
854 const struct disasm_index *ix;
856 int length, best_length = 0;
858 int i, slen, colon, n;
862 uint32_t goodness, best;
864 struct prefix_info prefix;
867 memset(&ins, 0, sizeof ins);
872 memset(&prefix, 0, sizeof prefix);
873 prefix.asize = segsize;
874 prefix.osize = (segsize == 64) ? 32 : segsize;
878 for (end_prefix = false; !end_prefix; ) {
882 prefix.rep = *data++;
885 prefix.lock = *data++;
888 segover = "cs", prefix.seg = *data++;
891 segover = "ss", prefix.seg = *data++;
894 segover = "ds", prefix.seg = *data++;
897 segover = "es", prefix.seg = *data++;
900 segover = "fs", prefix.seg = *data++;
903 segover = "gs", prefix.seg = *data++;
906 prefix.osize = (segsize == 16) ? 32 : 16;
907 prefix.osp = *data++;
910 prefix.asize = (segsize == 32) ? 16 : 32;
911 prefix.asp = *data++;
914 if (segsize == 64 && (*data & 0xf0) == REX_P) {
915 prefix.rex = *data++;
916 if (prefix.rex & REX_W)
925 best = -1; /* Worst possible */
931 while (ix->n == -1) {
932 ix = (const struct disasm_index *)ix->p + *dp++;
935 p = (const struct itemplate * const *)ix->p;
936 for (n = ix->n; n; n--, p++) {
937 if ((length = matches(*p, data, &prefix, segsize, &tmp_ins))) {
940 * Final check to make sure the types of r/m match up.
941 * XXX: Need to make sure this is actually correct.
943 for (i = 0; i < (*p)->operands; i++) {
944 if (!((*p)->opd[i] & SAME_AS) &&
946 /* If it's a mem-only EA but we have a
948 ((tmp_ins.oprs[i].segment & SEG_RMREG) &&
949 !(MEMORY & ~(*p)->opd[i])) ||
950 /* If it's a reg-only EA but we have a memory
952 (!(tmp_ins.oprs[i].segment & SEG_RMREG) &&
953 !(REG_EA & ~(*p)->opd[i]) &&
954 !((*p)->opd[i] & REG_SMASK)) ||
955 /* Register type mismatch (eg FS vs REG_DESS):
957 ((((*p)->opd[i] & (REGISTER | FPUREG)) ||
958 (tmp_ins.oprs[i].segment & SEG_RMREG)) &&
959 !whichreg((*p)->opd[i],
960 tmp_ins.oprs[i].basereg, tmp_ins.rex))
968 * Note: we always prefer instructions which incorporate
969 * prefixes in the instructions themselves. This is to allow
970 * e.g. PAUSE to be preferred to REP NOP, and deal with
971 * MMX/SSE instructions where prefixes are used to select
972 * between MMX and SSE register sets or outright opcode
977 goodness = ((*p)->flags & IF_PFMASK) ^ prefer;
979 for (i = 0; i < MAXPREFIX; i++)
980 if (tmp_ins.prefixes[i])
982 if (nprefix < best_pref ||
983 (nprefix == best_pref && goodness < best)) {
984 /* This is the best one found so far */
988 best_length = length;
996 return 0; /* no instruction was matched */
998 /* Pick the best match */
1000 length = best_length;
1004 /* TODO: snprintf returns the value that the string would have if
1005 * the buffer were long enough, and not the actual length of
1006 * the returned string, so each instance of using the return
1007 * value of snprintf should actually be checked to assure that
1008 * the return value is "sane." Maybe a macro wrapper could
1009 * be used for that purpose.
1011 for (i = 0; i < MAXPREFIX; i++)
1012 switch (ins.prefixes[i]) {
1014 slen += snprintf(output + slen, outbufsize - slen, "lock ");
1017 slen += snprintf(output + slen, outbufsize - slen, "rep ");
1020 slen += snprintf(output + slen, outbufsize - slen, "repe ");
1023 slen += snprintf(output + slen, outbufsize - slen, "repne ");
1026 slen += snprintf(output + slen, outbufsize - slen, "a16 ");
1029 slen += snprintf(output + slen, outbufsize - slen, "a32 ");
1032 slen += snprintf(output + slen, outbufsize - slen, "a64 ");
1035 slen += snprintf(output + slen, outbufsize - slen, "o16 ");
1038 slen += snprintf(output + slen, outbufsize - slen, "o32 ");
1041 slen += snprintf(output + slen, outbufsize - slen, "o64 ");
1047 for (i = 0; i < (int)elements(ico); i++)
1048 if ((*p)->opcode == ico[i]) {
1050 snprintf(output + slen, outbufsize - slen, "%s%s", icn[i],
1051 whichcond(ins.condition));
1054 if (i >= (int)elements(ico))
1056 snprintf(output + slen, outbufsize - slen, "%s",
1057 insn_names[(*p)->opcode]);
1059 length += data - origdata; /* fix up for prefixes */
1060 for (i = 0; i < (*p)->operands; i++) {
1061 opflags_t t = (*p)->opd[i];
1062 const operand *o = &ins.oprs[i];
1066 o = &ins.oprs[t & ~SAME_AS];
1067 t = (*p)->opd[t & ~SAME_AS];
1070 output[slen++] = (colon ? ':' : i == 0 ? ' ' : ',');
1073 if (o->segment & SEG_RELATIVE) {
1074 offs += offset + length;
1076 * sort out wraparound
1078 if (!(o->segment & (SEG_32BIT|SEG_64BIT)))
1081 * add sync marker, if autosync is on
1092 if ((t & (REGISTER | FPUREG)) ||
1093 (o->segment & SEG_RMREG)) {
1095 reg = whichreg(t, o->basereg, ins.rex);
1097 slen += snprintf(output + slen, outbufsize - slen, "to ");
1098 slen += snprintf(output + slen, outbufsize - slen, "%s",
1099 reg_names[reg - EXPR_REG_START]);
1100 } else if (!(UNITY & ~t)) {
1101 output[slen++] = '1';
1102 } else if (t & IMMEDIATE) {
1105 snprintf(output + slen, outbufsize - slen, "byte ");
1106 if (o->segment & SEG_SIGNED) {
1109 output[slen++] = '-';
1111 output[slen++] = '+';
1113 } else if (t & BITS16) {
1115 snprintf(output + slen, outbufsize - slen, "word ");
1116 } else if (t & BITS32) {
1118 snprintf(output + slen, outbufsize - slen, "dword ");
1119 } else if (t & BITS64) {
1121 snprintf(output + slen, outbufsize - slen, "qword ");
1122 } else if (t & NEAR) {
1124 snprintf(output + slen, outbufsize - slen, "near ");
1125 } else if (t & SHORT) {
1127 snprintf(output + slen, outbufsize - slen, "short ");
1130 snprintf(output + slen, outbufsize - slen, "0x%"PRIx64"",
1132 } else if (!(MEM_OFFS & ~t)) {
1134 snprintf(output + slen, outbufsize - slen,
1135 "[%s%s%s0x%"PRIx64"]",
1136 (segover ? segover : ""),
1137 (segover ? ":" : ""),
1138 (o->disp_size == 64 ? "qword " :
1139 o->disp_size == 32 ? "dword " :
1140 o->disp_size == 16 ? "word " : ""), offs);
1142 } else if (!(REGMEM & ~t)) {
1143 int started = false;
1146 snprintf(output + slen, outbufsize - slen, "byte ");
1149 snprintf(output + slen, outbufsize - slen, "word ");
1152 snprintf(output + slen, outbufsize - slen, "dword ");
1155 snprintf(output + slen, outbufsize - slen, "qword ");
1158 snprintf(output + slen, outbufsize - slen, "tword ");
1161 snprintf(output + slen, outbufsize - slen, "oword ");
1163 slen += snprintf(output + slen, outbufsize - slen, "far ");
1166 snprintf(output + slen, outbufsize - slen, "near ");
1167 output[slen++] = '[';
1169 slen += snprintf(output + slen, outbufsize - slen, "%s",
1170 (o->disp_size == 64 ? "qword " :
1171 o->disp_size == 32 ? "dword " :
1172 o->disp_size == 16 ? "word " :
1174 if (o->eaflags & EAF_REL)
1175 slen += snprintf(output + slen, outbufsize - slen, "rel ");
1178 snprintf(output + slen, outbufsize - slen, "%s:",
1182 if (o->basereg != -1) {
1183 slen += snprintf(output + slen, outbufsize - slen, "%s",
1184 reg_names[(o->basereg -
1188 if (o->indexreg != -1) {
1190 output[slen++] = '+';
1191 slen += snprintf(output + slen, outbufsize - slen, "%s",
1192 reg_names[(o->indexreg -
1196 snprintf(output + slen, outbufsize - slen, "*%d",
1202 if (o->segment & SEG_DISP8) {
1204 uint8_t offset = offs;
1205 if ((int8_t)offset < 0) {
1212 snprintf(output + slen, outbufsize - slen, "%s0x%"PRIx8"",
1214 } else if (o->segment & SEG_DISP16) {
1216 uint16_t offset = offs;
1217 if ((int16_t)offset < 0 && started) {
1221 prefix = started ? "+" : "";
1224 snprintf(output + slen, outbufsize - slen,
1225 "%s0x%"PRIx16"", prefix, offset);
1226 } else if (o->segment & SEG_DISP32) {
1227 if (prefix.asize == 64) {
1229 uint64_t offset = (int64_t)(int32_t)offs;
1230 if ((int32_t)offs < 0 && started) {
1234 prefix = started ? "+" : "";
1237 snprintf(output + slen, outbufsize - slen,
1238 "%s0x%"PRIx64"", prefix, offset);
1241 uint32_t offset = offs;
1242 if ((int32_t) offset < 0 && started) {
1246 prefix = started ? "+" : "";
1249 snprintf(output + slen, outbufsize - slen,
1250 "%s0x%"PRIx32"", prefix, offset);
1253 output[slen++] = ']';
1256 snprintf(output + slen, outbufsize - slen, "<operand%d>",
1260 output[slen] = '\0';
1261 if (segover) { /* unused segment override */
1263 int count = slen + 1;
1265 p[count + 3] = p[count];
1266 strncpy(output, segover, 2);
1272 int32_t eatbyte(uint8_t *data, char *output, int outbufsize)
1274 snprintf(output, outbufsize, "db 0x%02X", *data);