[: www.piotrbania.com :] Disit - OPEN SOURCE DISASSEMBLER ENGINE

DISIT

OPEN SOURCE DISASSEMBLER ENGINE
http://www.piotrbania.com

UPDATE 2009:

This project is now closed with last version (01C-BETA) released on 09.09.2006 . Disit 02-STABLE with support for FPU, SSE, SSE2 instructions based on more stable, fixed, partially re-designed engine will not be available to public.

VERSION:	[09/09/2006] - current release: 01C-BETA - DOWNLOAD [view changes]. [21/04/2006] - current release: 01B-BETA - DOWNLOAD. [30/01/2006] - previous release: 01A-BETA - DOWNLOAD.
NOTES:	This is the first release of DISIT, next ones should contains some major fixes (especially "flags" stuff). Currently it handles most of PENTIUM III general purpose instructions. Enjoy the engine, fixes, contributions are highly welcome as always.

FILES IN THE PACKAGE:	- disasm.cpp - core of the library - disasm.h - internal instructions maps and main structures - disasm_structs.h - some other declarations
MAIN FUNCTION:	*int _disasm(unsigned char instr, _dis_data dis_data)* Where: - instr - pointer to instruction to disassemble (in) - dis_data - _dis_data structure (out) Return values: - instruction length on success - NULL if error occurred
_DISDATA STRUCT:	typedef struct __dis_data { int len; // length of instruction unsigned char prefix[3]; // prefix bytes (up to 3) unsigned char seg; // currently selected segment unsigned char w_bit; // write bit occurency unsigned char s_bit; // size bit occurency unsigned char opcode; // opcode value unsigned char opcode2; // second opcode value unsigned char modrm; // modrm value unsigned char mem_act; // mem used as: 0-dest / 1-src unsigned long mem_regs; // registers used for memory operations unsigned char use_sib; // sib occurency flag unsigned char sib; // sib value unsigned char sib_mul; // sib multipler unsigned long sib_mul_reg; // important (reg used for multiply) unsigned long mem_imm; // immediate for mem unsigned long mem_imm_size; // size of immediate for mem unsigned char mem_super_size; // important only if not zero unsigned long src_regs; // source regs unsigned long dst_regs; // destination regs unsigned long i_src_regs; // a view of src regs unsigned long i_dst_regs; // a view of dest regs unsigned long flags; // currently reserved unsigned char spec_regs_on; // special regs flags marker unsigned char spec_regs; // special regs (DRx/CRX/etc.) unsigned char spec_flag; // call/jump flags unsigned short selector; // selector unsigned char default_addr; // size of addr unsigned char default_data; // size of data unsigned long imm_data; // immediate data unsigned char imm_size; // immediate size unsigned char imm_signextend; // sign extension flag unsigned long reserved; // special super cases (tttn and others) unsigned char reserved_size; // reserved char instr_out[50]; // text instrunction interpretation char instr_dump[24]; // text byte dump char prefix_t[20]; // text for prefix } _dis_data;
EXAMPLES:	1) Disassembling "add eax,edx" instruction: Few members of _dis_data struct members (output): len = 02 // instruction length opcode = 03 // instruction opcode modrm = c2 // modrm value dst_regs = 0000000f (EAX+) // destination register src_regs = 00000f0f (EAX+EDX+) // source registers i_dst_regs = 0000000f (EAX+) // syntax view i_src_regs = 00000f00 (EDX+) // syntax view Last two members presented (i_dst_regs/i_src_regs) shows the view of the registers "directly" based on the instruction syntax. *2) Disassembling "push dword ptr [edx+ecx8+10h]" instruction:** Few members of _dis_data struct members (output): len = 04 // instruction length opcode = ff // instruction opcode modrm = 74 // modrm value dst_regs = 00030000 (ESP+) // used by instruction as dest src_regs = 00030ff0 (ECX+EDX+ESP) // used by instruction as src i_dst_regs = 00000000 () // blank i_src_regs = 00000000 () // blank mem_act = 00 (SOURCE) // mem request as source mem_regs = 00000ff0 (ECX+EDX+) // regs used for mem operation mem_imm = 0010 // here it is 10h mem_imm_size = 01 // size of mem imm operand use_sib = 01 // we use sib here (1=true) sib = ca // value of sib byte sib_mul = 08 // the multipler sib_mul_reg = 000000f0 (ECX+) // reg which will be multipled
USAGE:	All you need to do is to place following line in the header of your proggie: #include "disit/disasm.h" and then play with _disasm function like: _dis_data dis_datex; _disasm((unsigned char*)(memory), &dis_datex);