1 /* disasm.c where all the _work_ gets done in the Netwide Disassembler
3 * The Netwide Assembler is copyright (C) 1996 Simon Tatham and
4 * Julian Hall. All rights reserved. The software is
5 * redistributable under the licence given in the file "Licence"
6 * distributed in the NASM archive.
8 * initial version 27/iii/95 by Simon Tatham
21 extern struct itemplate **itable[];
24 * Flags that go into the `segment' field of `insn' structures
27 #define SEG_RELATIVE 1
34 #define SEG_SIGNED 128
36 static int whichreg(long regflags, int regval) {
37 static int reg32[] = {
38 R_EAX, R_ECX, R_EDX, R_EBX, R_ESP, R_EBP, R_ESI, R_EDI };
39 static int reg16[] = {
40 R_AX, R_CX, R_DX, R_BX, R_SP, R_BP, R_SI, R_DI };
42 R_AL, R_CL, R_DL, R_BL, R_AH, R_CH, R_DH, R_BH };
44 R_ES, R_CS, R_SS, R_DS, R_FS, R_GS, 0, 0 };
46 R_CR0, 0, R_CR2, R_CR3, R_CR4, 0, 0, 0 };
48 R_DR0, R_DR1, R_DR2, R_DR3, 0, 0, R_DR6, R_DR7 };
50 0, 0, 0, R_TR3, R_TR4, R_TR5, R_TR6, R_TR7 };
51 static int fpureg[] = {
52 R_ST0, R_ST1, R_ST2, R_ST3, R_ST4, R_ST5, R_ST6, R_ST7 };
53 static int mmxreg[] = {
54 R_MM0, R_MM1, R_MM2, R_MM3, R_MM4, R_MM5, R_MM6, R_MM7 };
56 if (!(REG_AL & ~regflags))
58 if (!(REG_AX & ~regflags))
60 if (!(REG_EAX & ~regflags))
62 if (!(REG_DX & ~regflags))
64 if (!(REG_CL & ~regflags))
66 if (!(REG_CX & ~regflags))
68 if (!(REG_ECX & ~regflags))
70 if (!(REG_CR4 & ~regflags))
72 if (!(FPU0 & ~regflags))
74 if (!(REG_CS & ~regflags))
76 if (!((REGMEM|BITS8) & ~regflags))
78 if (!((REGMEM|BITS16) & ~regflags))
80 if (!((REGMEM|BITS32) & ~regflags))
82 if (!(REG_SREG & ~regflags))
84 if (!(REG_CREG & ~regflags))
86 if (!(REG_DREG & ~regflags))
88 if (!(REG_TREG & ~regflags))
90 if (!(FPUREG & ~regflags))
91 return fpureg[regval];
92 if (!(MMXREG & ~regflags))
93 return mmxreg[regval];
97 static char *whichcond(int condval) {
98 static int conds[] = {
99 C_O, C_NO, C_B, C_AE, C_E, C_NE, C_BE, C_A,
100 C_S, C_NS, C_PE, C_PO, C_L, C_GE, C_LE, C_G
102 return conditions[conds[condval]];
106 * Process an effective address (ModRM) specification.
108 static unsigned char *do_ea (unsigned char *data, int modrm, int asize,
109 int segsize, operand *op) {
110 int mod, rm, scale, index, base;
112 mod = (modrm >> 6) & 03;
115 if (mod == 3) { /* pure register version */
117 op->segment |= SEG_RMREG;
125 * <mod> specifies the displacement size (none, byte or
126 * word), and <rm> specifies the register combination.
127 * Exception: mod=0,rm=6 does not specify [BP] as one might
128 * expect, but instead specifies [disp16].
130 op->indexreg = op->basereg = -1;
131 op->scale = 1; /* always, in 16 bits */
133 case 0: op->basereg = R_BX; op->indexreg = R_SI; break;
134 case 1: op->basereg = R_BX; op->indexreg = R_DI; break;
135 case 2: op->basereg = R_BP; op->indexreg = R_SI; break;
136 case 3: op->basereg = R_BP; op->indexreg = R_DI; break;
137 case 4: op->basereg = R_SI; break;
138 case 5: op->basereg = R_DI; break;
139 case 6: op->basereg = R_BP; break;
140 case 7: op->basereg = R_BX; break;
142 if (rm == 6 && mod == 0) { /* special case */
146 mod = 2; /* fake disp16 */
150 op->segment |= SEG_NODISP;
153 op->segment |= SEG_DISP8;
154 op->offset = (signed char) *data++;
157 op->segment |= SEG_DISP16;
158 op->offset = *data++;
159 op->offset |= (*data++) << 8;
165 * Once again, <mod> specifies displacement size (this time
166 * none, byte or *dword*), while <rm> specifies the base
167 * register. Again, [EBP] is missing, replaced by a pure
168 * disp32 (this time that's mod=0,rm=*5*). However, rm=4
169 * indicates not a single base register, but instead the
170 * presence of a SIB byte...
174 case 0: op->basereg = R_EAX; break;
175 case 1: op->basereg = R_ECX; break;
176 case 2: op->basereg = R_EDX; break;
177 case 3: op->basereg = R_EBX; break;
178 case 5: op->basereg = R_EBP; break;
179 case 6: op->basereg = R_ESI; break;
180 case 7: op->basereg = R_EDI; break;
182 if (rm == 5 && mod == 0) {
186 mod = 2; /* fake disp32 */
188 if (rm == 4) { /* process SIB */
189 scale = (*data >> 6) & 03;
190 index = (*data >> 3) & 07;
194 op->scale = 1 << scale;
196 case 0: op->indexreg = R_EAX; break;
197 case 1: op->indexreg = R_ECX; break;
198 case 2: op->indexreg = R_EDX; break;
199 case 3: op->indexreg = R_EBX; break;
200 case 4: op->indexreg = -1; break;
201 case 5: op->indexreg = R_EBP; break;
202 case 6: op->indexreg = R_ESI; break;
203 case 7: op->indexreg = R_EDI; break;
207 case 0: op->basereg = R_EAX; break;
208 case 1: op->basereg = R_ECX; break;
209 case 2: op->basereg = R_EDX; break;
210 case 3: op->basereg = R_EBX; break;
211 case 4: op->basereg = R_ESP; break;
212 case 6: op->basereg = R_ESI; break;
213 case 7: op->basereg = R_EDI; break;
225 op->segment |= SEG_NODISP;
228 op->segment |= SEG_DISP8;
229 op->offset = (signed char) *data++;
232 op->segment |= SEG_DISP32;
233 op->offset = *data++;
234 op->offset |= (*data++) << 8;
235 op->offset |= ((long) *data++) << 16;
236 op->offset |= ((long) *data++) << 24;
244 * Determine whether the code string in r corresponds to the data
245 * stream in data. Return the number of bytes matched if so.
247 static int matches (unsigned char *r, unsigned char *data, int asize,
248 int osize, int segsize, insn *ins) {
249 unsigned char *origdata = data;
250 int a_used = FALSE, o_used = FALSE;
254 if (c >= 01 && c <= 03) {
261 case 0x07: ins->oprs[0].basereg = 0; break;
262 case 0x17: ins->oprs[0].basereg = 2; break;
263 case 0x1F: ins->oprs[0].basereg = 3; break;
264 default: return FALSE;
269 case 0xA1: ins->oprs[0].basereg = 4; break;
270 case 0xA9: ins->oprs[0].basereg = 5; break;
271 default: return FALSE;
276 case 0x06: ins->oprs[0].basereg = 0; break;
277 case 0x0E: ins->oprs[0].basereg = 1; break;
278 case 0x16: ins->oprs[0].basereg = 2; break;
279 case 0x1E: ins->oprs[0].basereg = 3; break;
280 default: return FALSE;
285 case 0xA0: ins->oprs[0].basereg = 4; break;
286 case 0xA8: ins->oprs[0].basereg = 5; break;
287 default: return FALSE;
290 if (c >= 010 && c <= 012) {
291 int t = *r++, d = *data++;
292 if (d < t || d > t+7)
295 ins->oprs[c-010].basereg = d-t;
296 ins->oprs[c-010].segment |= SEG_RMREG;
302 if (c >= 014 && c <= 016) {
303 ins->oprs[c-014].offset = (signed char) *data++;
304 ins->oprs[c-014].segment |= SEG_SIGNED;
306 if (c >= 020 && c <= 022)
307 ins->oprs[c-020].offset = *data++;
308 if (c >= 024 && c <= 026)
309 ins->oprs[c-024].offset = *data++;
310 if (c >= 030 && c <= 032) {
311 ins->oprs[c-030].offset = *data++;
312 ins->oprs[c-030].offset |= (*data++ << 8);
314 if (c >= 034 && c <= 036) {
315 ins->oprs[c-034].offset = *data++;
316 ins->oprs[c-034].offset |= (*data++ << 8);
318 ins->oprs[c-034].offset |= (((long) *data++) << 16);
319 ins->oprs[c-034].offset |= (((long) *data++) << 24);
321 if (segsize != asize)
322 ins->oprs[c-034].addr_size = asize;
324 if (c >= 040 && c <= 042) {
325 ins->oprs[c-040].offset = *data++;
326 ins->oprs[c-040].offset |= (*data++ << 8);
327 ins->oprs[c-040].offset |= (((long) *data++) << 16);
328 ins->oprs[c-040].offset |= (((long) *data++) << 24);
330 if (c >= 050 && c <= 052) {
331 ins->oprs[c-050].offset = (signed char) *data++;
332 ins->oprs[c-050].segment |= SEG_RELATIVE;
334 if (c >= 060 && c <= 062) {
335 ins->oprs[c-060].offset = *data++;
336 ins->oprs[c-060].offset |= (*data++ << 8);
337 ins->oprs[c-060].segment |= SEG_RELATIVE;
338 ins->oprs[c-060].segment &= ~SEG_32BIT;
340 if (c >= 064 && c <= 066) {
341 ins->oprs[c-064].offset = *data++;
342 ins->oprs[c-064].offset |= (*data++ << 8);
344 ins->oprs[c-064].offset |= (((long) *data++) << 16);
345 ins->oprs[c-064].offset |= (((long) *data++) << 24);
346 ins->oprs[c-064].segment |= SEG_32BIT;
348 ins->oprs[c-064].segment &= ~SEG_32BIT;
349 ins->oprs[c-064].segment |= SEG_RELATIVE;
350 if (segsize != asize)
351 ins->oprs[c-064].addr_size = asize;
353 if (c >= 070 && c <= 072) {
354 ins->oprs[c-070].offset = *data++;
355 ins->oprs[c-070].offset |= (*data++ << 8);
356 ins->oprs[c-070].offset |= (((long) *data++) << 16);
357 ins->oprs[c-070].offset |= (((long) *data++) << 24);
358 ins->oprs[c-070].segment |= SEG_32BIT | SEG_RELATIVE;
360 if (c >= 0100 && c <= 0177) {
362 ins->oprs[c & 07].basereg = (modrm >> 3) & 07;
363 ins->oprs[c & 07].segment |= SEG_RMREG;
364 data = do_ea (data, modrm, asize, segsize,
365 &ins->oprs[(c >> 3) & 07]);
367 if (c >= 0200 && c <= 0277) {
369 if (((modrm >> 3) & 07) != (c & 07))
370 return FALSE; /* spare field doesn't match up */
371 data = do_ea (data, modrm, asize, segsize,
372 &ins->oprs[(c >> 3) & 07]);
374 if (c >= 0300 && c <= 0302) {
376 ins->oprs[c-0300].segment |= SEG_32BIT;
378 ins->oprs[c-0300].segment &= ~SEG_32BIT;
394 if (asize != segsize)
412 if (osize != segsize)
418 int t = *r++, d = *data++;
419 if (d < t || d > t+15)
422 ins->condition = d - t;
427 * Check for unused a/o prefixes.
430 if (!a_used && asize != segsize)
431 ins->prefixes[ins->nprefix++] = (asize == 16 ? P_A16 : P_A32);
432 if (!o_used && osize != segsize)
433 ins->prefixes[ins->nprefix++] = (osize == 16 ? P_O16 : P_O32);
435 return data - origdata;
438 long disasm (unsigned char *data, char *output, int segsize, long offset,
440 struct itemplate **p;
443 int rep, lock, asize, osize, i, slen, colon;
444 unsigned char *origdata;
451 asize = osize = segsize;
456 if (*data == 0xF3 || *data == 0xF2)
458 else if (*data == 0xF0)
460 else if (*data == 0x2E || *data == 0x36 || *data == 0x3E ||
461 *data == 0x26 || *data == 0x64 || *data == 0x65) {
463 case 0x2E: segover = "cs"; break;
464 case 0x36: segover = "ss"; break;
465 case 0x3E: segover = "ds"; break;
466 case 0x26: segover = "es"; break;
467 case 0x64: segover = "fs"; break;
468 case 0x65: segover = "gs"; break;
470 } else if (*data == 0x66)
471 osize = 48 - segsize, data++;
472 else if (*data == 0x67)
473 asize = 48 - segsize, data++;
478 ins.oprs[0].segment = ins.oprs[1].segment = ins.oprs[2].segment =
479 ins.oprs[0].addr_size = ins.oprs[1].addr_size = ins.oprs[2].addr_size =
480 (segsize == 16 ? 0 : SEG_32BIT);
483 for (p = itable[*data]; *p; p++)
484 if ( (length = matches((unsigned char *)((*p)->code), data,
485 asize, osize, segsize, &ins)) ) {
488 * Final check to make sure the types of r/m match up.
490 for (i = 0; i < (*p)->operands; i++)
491 if (((ins.oprs[i].segment & SEG_RMREG) &&
492 !(MEMORY & ~(*p)->opd[i])) ||
493 (!(ins.oprs[i].segment & SEG_RMREG) &&
494 !(REGNORM & ~(*p)->opd[i]) &&
495 !((*p)->opd[i] & REG_SMASK)))
500 if (!length || !works)
501 return 0; /* no instruction was matched */
506 slen += sprintf(output+slen, "rep%s ",
507 (rep == 0xF2 ? "ne" :
508 (*p)->opcode == I_CMPSB ||
509 (*p)->opcode == I_CMPSW ||
510 (*p)->opcode == I_CMPSD ||
511 (*p)->opcode == I_SCASB ||
512 (*p)->opcode == I_SCASW ||
513 (*p)->opcode == I_SCASD ? "e" : ""));
516 slen += sprintf(output+slen, "lock ");
517 for (i = 0; i < ins.nprefix; i++)
518 switch (ins.prefixes[i]) {
519 case P_A16: slen += sprintf(output+slen, "a16 "); break;
520 case P_A32: slen += sprintf(output+slen, "a32 "); break;
521 case P_O16: slen += sprintf(output+slen, "o16 "); break;
522 case P_O32: slen += sprintf(output+slen, "o32 "); break;
525 for (i = 0; i < elements(ico); i++)
526 if ((*p)->opcode == ico[i]) {
527 slen += sprintf(output+slen, "%s%s", icn[i],
528 whichcond(ins.condition));
531 if (i >= elements(ico))
532 slen += sprintf(output+slen, "%s", insn_names[(*p)->opcode]);
534 length += data - origdata; /* fix up for prefixes */
535 for (i=0; i<(*p)->operands; i++) {
536 output[slen++] = (colon ? ':' : i==0 ? ' ' : ',');
538 if (ins.oprs[i].segment & SEG_RELATIVE) {
539 ins.oprs[i].offset += offset + length;
541 * sort out wraparound
543 if (!(ins.oprs[i].segment & SEG_32BIT))
544 ins.oprs[i].offset &= 0xFFFF;
546 * add sync marker, if autosync is on
549 add_sync (ins.oprs[i].offset, 0L);
552 if ((*p)->opd[i] & COLON)
557 if (((*p)->opd[i] & (REGISTER | FPUREG)) ||
558 (ins.oprs[i].segment & SEG_RMREG)) {
559 ins.oprs[i].basereg = whichreg ((*p)->opd[i],
560 ins.oprs[i].basereg);
561 slen += sprintf(output+slen, "%s",
562 reg_names[ins.oprs[i].basereg]);
563 } else if (!(UNITY & ~(*p)->opd[i])) {
564 output[slen++] = '1';
565 } else if ( (*p)->opd[i] & IMMEDIATE ) {
566 if ( (*p)->opd[i] & BITS8 ) {
567 slen += sprintf(output+slen, "byte ");
568 if (ins.oprs[i].segment & SEG_SIGNED) {
569 if (ins.oprs[i].offset < 0) {
570 ins.oprs[i].offset *= -1;
571 output[slen++] = '-';
573 output[slen++] = '+';
575 } else if ( (*p)->opd[i] & BITS16 ) {
576 slen += sprintf(output+slen, "word ");
577 } else if ( (*p)->opd[i] & BITS32 ) {
578 slen += sprintf(output+slen, "dword ");
579 } else if ( (*p)->opd[i] & NEAR ) {
580 slen += sprintf(output+slen, "near ");
581 } else if ( (*p)->opd[i] & SHORT ) {
582 slen += sprintf(output+slen, "short ");
584 slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
585 } else if ( !(MEM_OFFS & ~(*p)->opd[i]) ) {
586 slen += sprintf(output+slen, "[%s%s%s0x%lx]",
587 (segover ? segover : ""),
588 (segover ? ":" : ""),
589 (ins.oprs[i].addr_size == 32 ? "dword " :
590 ins.oprs[i].addr_size == 16 ? "word " : ""),
593 } else if ( !(REGMEM & ~(*p)->opd[i]) ) {
595 if ( (*p)->opd[i] & BITS8 )
596 slen += sprintf(output+slen, "byte ");
597 if ( (*p)->opd[i] & BITS16 )
598 slen += sprintf(output+slen, "word ");
599 if ( (*p)->opd[i] & BITS32 )
600 slen += sprintf(output+slen, "dword ");
601 if ( (*p)->opd[i] & BITS64 )
602 slen += sprintf(output+slen, "qword ");
603 if ( (*p)->opd[i] & BITS80 )
604 slen += sprintf(output+slen, "tword ");
605 if ( (*p)->opd[i] & FAR )
606 slen += sprintf(output+slen, "far ");
607 if ( (*p)->opd[i] & NEAR )
608 slen += sprintf(output+slen, "near ");
609 output[slen++] = '[';
610 if (ins.oprs[i].addr_size)
611 slen += sprintf(output+slen, "%s",
612 (ins.oprs[i].addr_size == 32 ? "dword " :
613 ins.oprs[i].addr_size == 16 ? "word " : ""));
615 slen += sprintf(output+slen, "%s:", segover);
618 if (ins.oprs[i].basereg != -1) {
619 slen += sprintf(output+slen, "%s",
620 reg_names[ins.oprs[i].basereg]);
623 if (ins.oprs[i].indexreg != -1) {
625 output[slen++] = '+';
626 slen += sprintf(output+slen, "%s",
627 reg_names[ins.oprs[i].indexreg]);
628 if (ins.oprs[i].scale > 1)
629 slen += sprintf(output+slen, "*%d", ins.oprs[i].scale);
632 if (ins.oprs[i].segment & SEG_DISP8) {
634 if (ins.oprs[i].offset & 0x80) {
635 ins.oprs[i].offset = - (signed char) ins.oprs[i].offset;
638 slen += sprintf(output+slen, "%c0x%lx", sign,
640 } else if (ins.oprs[i].segment & SEG_DISP16) {
642 output[slen++] = '+';
643 slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
644 } else if (ins.oprs[i].segment & SEG_DISP32) {
646 output[slen++] = '+';
647 slen += sprintf(output+slen, "0x%lx", ins.oprs[i].offset);
649 output[slen++] = ']';
651 slen += sprintf(output+slen, "<operand%d>", i);
655 if (segover) { /* unused segment override */
659 p[count+3] = p[count];
660 strncpy (output, segover, 2);
666 long eatbyte (unsigned char *data, char *output) {
667 sprintf(output, "db 0x%02X", *data);