1 /* disasm.c where all the _work_ gets done in the Netwide Disassembler
3 * The Netwide Assembler is copyright (C) 1996 Simon Tatham and
4 * Julian Hall. All rights reserved. The software is
5 * redistributable under the licence given in the file "Licence"
6 * distributed in the NASM archive.
8 * initial version 27/iii/95 by Simon Tatham
21 extern struct itemplate **itable[];
24 * Flags that go into the `segment' field of `insn' structures
27 #define SEG_RELATIVE 1
34 #define SEG_SIGNED 128
36 static int whichreg(long regflags, int regval)
40 if (!(REG_AL & ~regflags))
42 if (!(REG_AX & ~regflags))
44 if (!(REG_EAX & ~regflags))
46 if (!(REG_DX & ~regflags))
48 if (!(REG_CL & ~regflags))
50 if (!(REG_CX & ~regflags))
52 if (!(REG_ECX & ~regflags))
54 if (!(FPU0 & ~regflags))
56 if (!(REG_CS & ~regflags))
57 return (regval == 1) ? R_CS : 0;
58 if (!(REG_DESS & ~regflags))
59 return (regval == 0 || regval == 2 || regval == 3 ? sreg[regval] : 0);
60 if (!(REG_FSGS & ~regflags))
61 return (regval == 4 || regval == 5 ? sreg[regval] : 0);
62 if (!(REG_SEG67 & ~regflags))
63 return (regval == 6 || regval == 7 ? sreg[regval] : 0);
65 /* All the entries below look up regval in an 8-entry array */
66 if (regval < 0 || regval > 7)
69 if (!((REGMEM|BITS8) & ~regflags))
71 if (!((REGMEM|BITS16) & ~regflags))
73 if (!((REGMEM|BITS32) & ~regflags))
75 if (!(REG_SREG & ~regflags))
77 if (!(REG_CREG & ~regflags))
79 if (!(REG_DREG & ~regflags))
81 if (!(REG_TREG & ~regflags))
83 if (!(FPUREG & ~regflags))
84 return fpureg[regval];
85 if (!(MMXREG & ~regflags))
86 return mmxreg[regval];
87 if (!(XMMREG & ~regflags))
88 return xmmreg[regval];
93 static const char *whichcond(int condval)
95 static int conds[] = {
96 C_O, C_NO, C_C, C_NC, C_Z, C_NZ, C_NA, C_A,
97 C_S, C_NS, C_PE, C_PO, C_L, C_NL, C_NG, C_G
99 return conditions[conds[condval]];
103 * Process an effective address (ModRM) specification.
105 static unsigned char *do_ea (unsigned char *data, int modrm, int asize,
106 int segsize, operand *op)
108 int mod, rm, scale, index, base;
110 mod = (modrm >> 6) & 03;
113 if (mod == 3) { /* pure register version */
115 op->segment |= SEG_RMREG;
123 * <mod> specifies the displacement size (none, byte or
124 * word), and <rm> specifies the register combination.
125 * Exception: mod=0,rm=6 does not specify [BP] as one might
126 * expect, but instead specifies [disp16].
128 op->indexreg = op->basereg = -1;
129 op->scale = 1; /* always, in 16 bits */
131 case 0: op->basereg = R_BX; op->indexreg = R_SI; break;
132 case 1: op->basereg = R_BX; op->indexreg = R_DI; break;
133 case 2: op->basereg = R_BP; op->indexreg = R_SI; break;
134 case 3: op->basereg = R_BP; op->indexreg = R_DI; break;
135 case 4: op->basereg = R_SI; break;
136 case 5: op->basereg = R_DI; break;
137 case 6: op->basereg = R_BP; break;
138 case 7: op->basereg = R_BX; break;
140 if (rm == 6 && mod == 0) { /* special case */
144 mod = 2; /* fake disp16 */
148 op->segment |= SEG_NODISP;
151 op->segment |= SEG_DISP8;
152 op->offset = (signed char) *data++;
155 op->segment |= SEG_DISP16;
156 op->offset = *data++;
157 op->offset |= (*data++) << 8;
163 * Once again, <mod> specifies displacement size (this time
164 * none, byte or *dword*), while <rm> specifies the base
165 * register. Again, [EBP] is missing, replaced by a pure
166 * disp32 (this time that's mod=0,rm=*5*). However, rm=4
167 * indicates not a single base register, but instead the
168 * presence of a SIB byte...
172 case 0: op->basereg = R_EAX; break;
173 case 1: op->basereg = R_ECX; break;
174 case 2: op->basereg = R_EDX; break;
175 case 3: op->basereg = R_EBX; break;
176 case 5: op->basereg = R_EBP; break;
177 case 6: op->basereg = R_ESI; break;
178 case 7: op->basereg = R_EDI; break;
180 if (rm == 5 && mod == 0) {
184 mod = 2; /* fake disp32 */
186 if (rm == 4) { /* process SIB */
187 scale = (*data >> 6) & 03;
188 index = (*data >> 3) & 07;
192 op->scale = 1 << scale;
194 case 0: op->indexreg = R_EAX; break;
195 case 1: op->indexreg = R_ECX; break;
196 case 2: op->indexreg = R_EDX; break;
197 case 3: op->indexreg = R_EBX; break;
198 case 4: op->indexreg = -1; break;
199 case 5: op->indexreg = R_EBP; break;
200 case 6: op->indexreg = R_ESI; break;
201 case 7: op->indexreg = R_EDI; break;
205 case 0: op->basereg = R_EAX; break;
206 case 1: op->basereg = R_ECX; break;
207 case 2: op->basereg = R_EDX; break;
208 case 3: op->basereg = R_EBX; break;
209 case 4: op->basereg = R_ESP; break;
210 case 6: op->basereg = R_ESI; break;
211 case 7: op->basereg = R_EDI; break;
223 op->segment |= SEG_NODISP;
226 op->segment |= SEG_DISP8;
227 op->offset = (signed char) *data++;
230 op->segment |= SEG_DISP32;
231 op->offset = *data++;
232 op->offset |= (*data++) << 8;
233 op->offset |= ((long) *data++) << 16;
234 op->offset |= ((long) *data++) << 24;
242 * Determine whether the instruction template in t corresponds to the data
243 * stream in data. Return the number of bytes matched if so.
245 static int matches (struct itemplate *t, unsigned char *data, int asize,
246 int osize, int segsize, int rep, insn *ins)
248 unsigned char * r = (unsigned char *)(t->code);
249 unsigned char * origdata = data;
250 int a_used = FALSE, o_used = FALSE;
255 else if ( rep == 0xF3 )
261 if (c >= 01 && c <= 03) {
268 case 0x07: ins->oprs[0].basereg = 0; break;
269 case 0x17: ins->oprs[0].basereg = 2; break;
270 case 0x1F: ins->oprs[0].basereg = 3; break;
271 default: return FALSE;
276 case 0xA1: ins->oprs[0].basereg = 4; break;
277 case 0xA9: ins->oprs[0].basereg = 5; break;
278 default: return FALSE;
283 case 0x06: ins->oprs[0].basereg = 0; break;
284 case 0x0E: ins->oprs[0].basereg = 1; break;
285 case 0x16: ins->oprs[0].basereg = 2; break;
286 case 0x1E: ins->oprs[0].basereg = 3; break;
287 default: return FALSE;
292 case 0xA0: ins->oprs[0].basereg = 4; break;
293 case 0xA8: ins->oprs[0].basereg = 5; break;
294 default: return FALSE;
297 if (c >= 010 && c <= 012) {
298 int t = *r++, d = *data++;
299 if (d < t || d > t+7)
302 ins->oprs[c-010].basereg = d-t;
303 ins->oprs[c-010].segment |= SEG_RMREG;
309 if (c >= 014 && c <= 016) {
310 ins->oprs[c-014].offset = (signed char) *data++;
311 ins->oprs[c-014].segment |= SEG_SIGNED;
313 if (c >= 020 && c <= 022)
314 ins->oprs[c-020].offset = *data++;
315 if (c >= 024 && c <= 026)
316 ins->oprs[c-024].offset = *data++;
317 if (c >= 030 && c <= 032) {
318 ins->oprs[c-030].offset = *data++;
319 ins->oprs[c-030].offset |= (*data++ << 8);
321 if (c >= 034 && c <= 036) {
322 ins->oprs[c-034].offset = *data++;
323 ins->oprs[c-034].offset |= (*data++ << 8);
325 ins->oprs[c-034].offset |= (((long) *data++) << 16);
326 ins->oprs[c-034].offset |= (((long) *data++) << 24);
328 if (segsize != asize)
329 ins->oprs[c-034].addr_size = asize;
331 if (c >= 040 && c <= 042) {
332 ins->oprs[c-040].offset = *data++;
333 ins->oprs[c-040].offset |= (*data++ << 8);
334 ins->oprs[c-040].offset |= (((long) *data++) << 16);
335 ins->oprs[c-040].offset |= (((long) *data++) << 24);
337 if (c >= 044 && c <= 046) {
338 ins->oprs[c-044].offset = *data++;
339 ins->oprs[c-044].offset |= (*data++ << 8);
341 ins->oprs[c-044].offset |= (((long) *data++) << 16);
342 ins->oprs[c-044].offset |= (((long) *data++) << 24);
344 if (segsize != asize)
345 ins->oprs[c-044].addr_size = asize;
347 if (c >= 050 && c <= 052) {
348 ins->oprs[c-050].offset = (signed char) *data++;
349 ins->oprs[c-050].segment |= SEG_RELATIVE;
351 if (c >= 060 && c <= 062) {
352 ins->oprs[c-060].offset = *data++;
353 ins->oprs[c-060].offset |= (*data++ << 8);
354 ins->oprs[c-060].segment |= SEG_RELATIVE;
355 ins->oprs[c-060].segment &= ~SEG_32BIT;
357 if (c >= 064 && c <= 066) {
358 ins->oprs[c-064].offset = *data++;
359 ins->oprs[c-064].offset |= (*data++ << 8);
361 ins->oprs[c-064].offset |= (((long) *data++) << 16);
362 ins->oprs[c-064].offset |= (((long) *data++) << 24);
363 ins->oprs[c-064].segment |= SEG_32BIT;
365 ins->oprs[c-064].segment &= ~SEG_32BIT;
366 ins->oprs[c-064].segment |= SEG_RELATIVE;
367 if (segsize != osize) {
368 ins->oprs[c-064].type =
369 (ins->oprs[c-064].type & NON_SIZE)
370 | ((osize == 16) ? BITS16 : BITS32);
373 if (c >= 070 && c <= 072) {
374 ins->oprs[c-070].offset = *data++;
375 ins->oprs[c-070].offset |= (*data++ << 8);
376 ins->oprs[c-070].offset |= (((long) *data++) << 16);
377 ins->oprs[c-070].offset |= (((long) *data++) << 24);
378 ins->oprs[c-070].segment |= SEG_32BIT | SEG_RELATIVE;
380 if (c >= 0100 && c < 0130) {
382 ins->oprs[c & 07].basereg = (modrm >> 3) & 07;
383 ins->oprs[c & 07].segment |= SEG_RMREG;
384 data = do_ea (data, modrm, asize, segsize,
385 &ins->oprs[(c >> 3) & 07]);
387 if (c >= 0130 && c <= 0132) {
388 ins->oprs[c-0130].offset = *data++;
389 ins->oprs[c-0130].offset |= (*data++ << 8);
391 if (c >= 0140 && c <= 0142) {
392 ins->oprs[c-0140].offset = *data++;
393 ins->oprs[c-0140].offset |= (*data++ << 8);
394 ins->oprs[c-0140].offset |= (((long) *data++) << 16);
395 ins->oprs[c-0140].offset |= (((long) *data++) << 24);
397 if (c >= 0200 && c <= 0277) {
399 if (((modrm >> 3) & 07) != (c & 07))
400 return FALSE; /* spare field doesn't match up */
401 data = do_ea (data, modrm, asize, segsize,
402 &ins->oprs[(c >> 3) & 07]);
404 if (c >= 0300 && c <= 0302) {
406 ins->oprs[c-0300].segment |= SEG_32BIT;
408 ins->oprs[c-0300].segment &= ~SEG_32BIT;
424 if (asize != segsize)
442 if (osize != segsize)
448 int t = *r++, d = *data++;
449 if (d < t || d > t+15)
452 ins->condition = d - t;
470 * Check for unused rep or a/o prefixes.
474 ins->prefixes[ins->nprefix++] = drep;
475 if (!a_used && asize != segsize)
476 ins->prefixes[ins->nprefix++] = (asize == 16 ? P_A16 : P_A32);
477 if (!o_used && osize != segsize)
478 ins->prefixes[ins->nprefix++] = (osize == 16 ? P_O16 : P_O32);
480 return data - origdata;
483 long disasm (unsigned char *data, char *output, int segsize, long offset,
484 int autosync, unsigned long prefer)
486 struct itemplate **p, **best_p;
487 int length, best_length = 0;
489 int rep, lock, asize, osize, i, slen, colon;
490 unsigned char *origdata;
493 unsigned long goodness, best;
498 asize = osize = segsize;
503 if (*data == 0xF3 || *data == 0xF2)
505 else if (*data == 0xF0)
507 else if (*data == 0x2E || *data == 0x36 || *data == 0x3E ||
508 *data == 0x26 || *data == 0x64 || *data == 0x65) {
510 case 0x2E: segover = "cs"; break;
511 case 0x36: segover = "ss"; break;
512 case 0x3E: segover = "ds"; break;
513 case 0x26: segover = "es"; break;
514 case 0x64: segover = "fs"; break;
515 case 0x65: segover = "gs"; break;
517 } else if (*data == 0x66)
518 osize = 48 - segsize, data++;
519 else if (*data == 0x67)
520 asize = 48 - segsize, data++;
525 tmp_ins.oprs[0].segment = tmp_ins.oprs[1].segment =
526 tmp_ins.oprs[2].segment =
527 tmp_ins.oprs[0].addr_size = tmp_ins.oprs[1].addr_size =
528 tmp_ins.oprs[2].addr_size = (segsize == 16 ? 0 : SEG_32BIT);
529 tmp_ins.condition = -1;
530 best = ~0UL; /* Worst possible */
532 for (p = itable[*data]; *p; p++) {
533 if ( (length = matches(*p, data, asize, osize,
534 segsize, rep, &tmp_ins)) ) {
537 * Final check to make sure the types of r/m match up.
539 for (i = 0; i < (*p)->operands; i++) {
541 /* If it's a mem-only EA but we have a register, die. */
542 ((tmp_ins.oprs[i].segment & SEG_RMREG) &&
543 !(MEMORY & ~(*p)->opd[i])) ||
545 /* If it's a reg-only EA but we have a memory ref, die. */
546 (!(tmp_ins.oprs[i].segment & SEG_RMREG) &&
547 !(REGNORM & ~(*p)->opd[i]) &&
548 !((*p)->opd[i] & REG_SMASK)) ||
550 /* Register type mismatch (eg FS vs REG_DESS): die. */
551 ((((*p)->opd[i] & (REGISTER | FPUREG)) ||
552 (tmp_ins.oprs[i].segment & SEG_RMREG)) &&
553 !whichreg ((*p)->opd[i], tmp_ins.oprs[i].basereg))) {
560 goodness = ((*p)->flags & IF_PFMASK) ^ prefer;
561 if ( goodness < best ) {
562 /* This is the best one found so far */
565 best_length = length;
573 return 0; /* no instruction was matched */
575 /* Pick the best match */
577 length = best_length;
582 slen += sprintf(output+slen, "lock ");
583 for (i = 0; i < ins.nprefix; i++)
584 switch (ins.prefixes[i]) {
585 case P_REP: slen += sprintf(output+slen, "rep "); break;
586 case P_REPE: slen += sprintf(output+slen, "repe "); break;
587 case P_REPNE: slen += sprintf(output+slen, "repne "); break;
588 case P_A16: slen += sprintf(output+slen, "a16 "); break;
589 case P_A32: slen += sprintf(output+slen, "a32 "); break;
590 case P_O16: slen += sprintf(output+slen, "o16 "); break;
591 case P_O32: slen += sprintf(output+slen, "o32 "); break;
594 for (i = 0; i < elements(ico); i++)
595 if ((*p)->opcode == ico[i]) {
596 slen += sprintf(output+slen, "%s%s", icn[i],
597 whichcond(ins.condition));
600 if (i >= elements(ico))
601 slen += sprintf(output+slen, "%s", insn_names[(*p)->opcode]);
603 length += data - origdata; /* fix up for prefixes */
604 for (i=0; i<(*p)->operands; i++) {
605 output[slen++] = (colon ? ':' : i==0 ? ' ' : ',');
607 if (ins.oprs[i].segment & SEG_RELATIVE) {
608 ins.oprs[i].offset += offset + length;
610 * sort out wraparound
612 if (!(ins.oprs[i].segment & SEG_32BIT))
613 ins.oprs[i].offset &= 0xFFFF;
615 * add sync marker, if autosync is on
618 add_sync (ins.oprs[i].offset, 0L);
621 if ((*p)->opd[i] & COLON)
626 if (((*p)->opd[i] & (REGISTER | FPUREG)) ||
627 (ins.oprs[i].segment & SEG_RMREG))
629 ins.oprs[i].basereg = whichreg ((*p)->opd[i],
630 ins.oprs[i].basereg);
631 if ( (*p)->opd[i] & TO )
632 slen += sprintf(output+slen, "to ");
633 slen += sprintf(output+slen, "%s",
634 reg_names[ins.oprs[i].basereg-EXPR_REG_START]);
635 } else if (!(UNITY & ~(*p)->opd[i])) {
636 output[slen++] = '1';
637 } else if ( (*p)->opd[i] & IMMEDIATE ) {
638 if ( (*p)->opd[i] & BITS8 ) {
639 slen += sprintf(output+slen, "byte ");
640 if (ins.oprs[i].segment & SEG_SIGNED) {
641 if (ins.oprs[i].offset < 0) {
642 ins.oprs[i].offset *= -1;
643 output[slen++] = '-';
645 output[slen++] = '+';
647 } else if ( (*p)->opd[i] & BITS16 ) {
648 slen += sprintf(output+slen, "word ");
649 } else if ( (*p)->opd[i] & BITS32 ) {
650 slen += sprintf(output+slen, "dword ");
651 } else if ( (*p)->opd[i] & NEAR ) {
652 slen += sprintf(output+slen, "near ");
653 } else if ( (*p)->opd[i] & SHORT ) {
654 slen += sprintf(output+slen, "short ");
656 slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
657 } else if ( !(MEM_OFFS & ~(*p)->opd[i]) ) {
658 slen += sprintf(output+slen, "[%s%s%s0x%lx]",
659 (segover ? segover : ""),
660 (segover ? ":" : ""),
661 (ins.oprs[i].addr_size == 32 ? "dword " :
662 ins.oprs[i].addr_size == 16 ? "word " : ""),
665 } else if ( !(REGMEM & ~(*p)->opd[i]) ) {
667 if ( (*p)->opd[i] & BITS8 )
668 slen += sprintf(output+slen, "byte ");
669 if ( (*p)->opd[i] & BITS16 )
670 slen += sprintf(output+slen, "word ");
671 if ( (*p)->opd[i] & BITS32 )
672 slen += sprintf(output+slen, "dword ");
673 if ( (*p)->opd[i] & BITS64 )
674 slen += sprintf(output+slen, "qword ");
675 if ( (*p)->opd[i] & BITS80 )
676 slen += sprintf(output+slen, "tword ");
677 if ( (*p)->opd[i] & FAR )
678 slen += sprintf(output+slen, "far ");
679 if ( (*p)->opd[i] & NEAR )
680 slen += sprintf(output+slen, "near ");
681 output[slen++] = '[';
682 if (ins.oprs[i].addr_size)
683 slen += sprintf(output+slen, "%s",
684 (ins.oprs[i].addr_size == 32 ? "dword " :
685 ins.oprs[i].addr_size == 16 ? "word " : ""));
687 slen += sprintf(output+slen, "%s:", segover);
690 if (ins.oprs[i].basereg != -1) {
691 slen += sprintf(output+slen, "%s",
692 reg_names[(ins.oprs[i].basereg -
696 if (ins.oprs[i].indexreg != -1) {
698 output[slen++] = '+';
699 slen += sprintf(output+slen, "%s",
700 reg_names[(ins.oprs[i].indexreg -
702 if (ins.oprs[i].scale > 1)
703 slen += sprintf(output+slen, "*%d", ins.oprs[i].scale);
706 if (ins.oprs[i].segment & SEG_DISP8) {
708 if (ins.oprs[i].offset & 0x80) {
709 ins.oprs[i].offset = - (signed char) ins.oprs[i].offset;
712 slen += sprintf(output+slen, "%c0x%lx", sign,
714 } else if (ins.oprs[i].segment & SEG_DISP16) {
716 output[slen++] = '+';
717 slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
718 } else if (ins.oprs[i].segment & SEG_DISP32) {
720 output[slen++] = '+';
721 slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
723 output[slen++] = ']';
725 slen += sprintf(output+slen, "<operand%d>", i);
729 if (segover) { /* unused segment override */
733 p[count+3] = p[count];
734 strncpy (output, segover, 2);
740 long eatbyte (unsigned char *data, char *output)
742 sprintf(output, "db 0x%02X", *data);