1
|
1
|
new file mode 100644
|
...
|
...
|
@@ -0,0 +1,359 @@
|
|
0
|
+/*
|
|
1
|
+ * Copyright (C) 2008 Sourcefire, Inc.
|
|
2
|
+ *
|
|
3
|
+ * Authors: Török Edvin
|
|
4
|
+ *
|
|
5
|
+ * This program is free software; you can redistribute it and/or modify
|
|
6
|
+ * it under the terms of the GNU General Public License version 2 as
|
|
7
|
+ * published by the Free Software Foundation.
|
|
8
|
+ *
|
|
9
|
+ * This program is distributed in the hope that it will be useful,
|
|
10
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
11
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
12
|
+ * GNU General Public License for more details.
|
|
13
|
+ *
|
|
14
|
+ * You should have received a copy of the GNU General Public License
|
|
15
|
+ * along with this program; if not, write to the Free Software
|
|
16
|
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
|
|
17
|
+ * MA 02110-1301, USA.
|
|
18
|
+ */
|
|
19
|
+
|
|
20
|
+#ifndef DISASM_BC_H
|
|
21
|
+#define DISASM_BC_H
|
|
22
|
+/** @file */
|
|
23
|
+/** X86 opcode */
|
|
24
|
+enum X86OPS {
|
|
25
|
+ OP_INVALID,
|
|
26
|
+ OP_AAA,/**< Ascii Adjust after Addition */
|
|
27
|
+ OP_AAD,/**< Ascii Adjust AX before Division */
|
|
28
|
+ OP_AAM,/**< Ascii Adjust AX after Multiply */
|
|
29
|
+ OP_AAS,/**< Ascii Adjust AL after Subtraction */
|
|
30
|
+ OP_ADD,/**< Add */
|
|
31
|
+ OP_ADC,/**< Add with Carry */
|
|
32
|
+ OP_AND,/**< Logical And */
|
|
33
|
+ OP_ARPL,/**< Adjust Requested Privilege Level */
|
|
34
|
+ OP_BOUND,/**< Check Array Index Against Bounds */
|
|
35
|
+ OP_BSF,/**< Bit Scan Forward */
|
|
36
|
+ OP_BSR,/**< Bit Scan Reverse */
|
|
37
|
+ OP_BSWAP,/**< Byte Swap */
|
|
38
|
+ OP_BT,/**< Bit Test */
|
|
39
|
+ OP_BTC,/**< Bit Test and Complement */
|
|
40
|
+ OP_BTR,/**< Bit Test and Reset */
|
|
41
|
+ OP_BTS,/**< Bit Test and Set */
|
|
42
|
+ OP_CALL,/**< Call */
|
|
43
|
+ OP_CDQ,/**< Convert DoubleWord to QuadWord*/
|
|
44
|
+ OP_CWD,
|
|
45
|
+ OP_CWDE,/**< Convert Word to DoubleWord */
|
|
46
|
+ OP_CBW,/**< Convert Byte to Word */
|
|
47
|
+ OP_CLC,/**< Clear Carry Flag */
|
|
48
|
+ OP_CLD,/**< Clear Direction Flag */
|
|
49
|
+ OP_CLI,/**< Clear Interrupt Flag */
|
|
50
|
+ OP_CLTS,/**< Clear Task-Switched Flag in CR0 */
|
|
51
|
+ OP_CMC,/**< Complement Carry Flag */
|
|
52
|
+ OP_CMOVO,/**< Conditional Move if Overflow */
|
|
53
|
+ OP_CMOVNO,/**< Conditional Move if Not Overflow */
|
|
54
|
+ OP_CMOVC,/**< Conditional Move if Carry */
|
|
55
|
+ OP_CMOVNC,/**< Conditional Move if Not Carry */
|
|
56
|
+ OP_CMOVZ,/**< Conditional Move if Zero */
|
|
57
|
+ OP_CMOVNZ,/**< Conditional Move if Non-Zero */
|
|
58
|
+ OP_CMOVBE,/**< Conditional Move if Below or Equal */
|
|
59
|
+ OP_CMOVA,/**< Conditional Move if Above */
|
|
60
|
+ OP_CMOVS,/**< Conditional Move if Sign */
|
|
61
|
+ OP_CMOVNS,/**< Conditional Move if Not Sign */
|
|
62
|
+ OP_CMOVP,/**< Conditional Move if Parity */
|
|
63
|
+ OP_CMOVNP,/**< Conditional Move if Not Parity */
|
|
64
|
+ OP_CMOVL,/**< Conditional Move if Less */
|
|
65
|
+ OP_CMOVGE,/**< Conditional Move if Greater or Equal */
|
|
66
|
+ OP_CMOVLE,/**< Conditional Move if Less than or Equal */
|
|
67
|
+ OP_CMOVG,/**< Conditional Move if Greater */
|
|
68
|
+ OP_CMP,/**< Compare */
|
|
69
|
+ OP_CMPSD,/**< Compare String DoubleWord */
|
|
70
|
+ OP_CMPSW,/**< Compare String Word */
|
|
71
|
+ OP_CMPSB,/**< Compare String Byte */
|
|
72
|
+ OP_CMPXCHG,/**< Compare and Exchange */
|
|
73
|
+ OP_CMPXCHG8B,/**< Compare and Exchange Bytes */
|
|
74
|
+ OP_CPUID,/**< CPU Identification */
|
|
75
|
+ OP_DAA,/**< Decimal Adjust AL after Addition */
|
|
76
|
+ OP_DAS,/**< Decimal Adjust AL after Subtraction */
|
|
77
|
+ OP_DEC,/**< Decrement by 1 */
|
|
78
|
+ OP_DIV,/**< Unsigned Divide */
|
|
79
|
+ OP_ENTER,/**< Make Stack Frame for Procedure Parameters */
|
|
80
|
+ OP_FWAIT,/**< Wait */
|
|
81
|
+ OP_HLT,/**< Halt */
|
|
82
|
+ OP_IDIV,/**< Signed Divide */
|
|
83
|
+ OP_IMUL,/**< Signed Multiply */
|
|
84
|
+ OP_INC,/**< Increment by 1 */
|
|
85
|
+ OP_IN,/**< INput from port */
|
|
86
|
+ OP_INSD,/**< INput from port to String Doubleword */
|
|
87
|
+ OP_INSW,/**< INput from port to String Word */
|
|
88
|
+ OP_INSB,/**< INput from port to String Byte */
|
|
89
|
+ OP_INT,/**< INTerrupt */
|
|
90
|
+ OP_INT3,/**< INTerrupt 3 (breakpoint) */
|
|
91
|
+ OP_INTO,/**< INTerrupt 4 if Overflow */
|
|
92
|
+ OP_INVD,/**< Invalidate Internal Caches */
|
|
93
|
+ OP_INVLPG,/**< Invalidate TLB Entry */
|
|
94
|
+ OP_IRET,/**< Interrupt Return */
|
|
95
|
+ OP_JO,/**< Jump if Overflow */
|
|
96
|
+ OP_JNO,/**< Jump if Not Overflow */
|
|
97
|
+ OP_JC,/**< Jump if Carry */
|
|
98
|
+ OP_JNC,/**< Jump if Not Carry */
|
|
99
|
+ OP_JZ,/**< Jump if Zero */
|
|
100
|
+ OP_JNZ,/**< Jump if Not Zero */
|
|
101
|
+ OP_JBE,/**< Jump if Below or Equal */
|
|
102
|
+ OP_JA,/**< Jump if Above */
|
|
103
|
+ OP_JS,/**< Jump if Sign */
|
|
104
|
+ OP_JNS,/**< Jump if Not Sign */
|
|
105
|
+ OP_JP,/**< Jump if Parity */
|
|
106
|
+ OP_JNP,/**< Jump if Not Parity */
|
|
107
|
+ OP_JL,/**< Jump if Less */
|
|
108
|
+ OP_JGE,/**< Jump if Greater or Equal */
|
|
109
|
+ OP_JLE,/**< Jump if Less or Equal */
|
|
110
|
+ OP_JG,/**< Jump if Greater */
|
|
111
|
+ OP_JMP,/**< Jump (unconditional) */
|
|
112
|
+ OP_LAHF,/**< Load Status Flags into AH Register */
|
|
113
|
+ OP_LAR,/**< load Access Rights Byte */
|
|
114
|
+ OP_LDS,/**< Load Far Pointer into DS */
|
|
115
|
+ OP_LES,/**< Load Far Pointer into ES */
|
|
116
|
+ OP_LFS,/**< Load Far Pointer into FS */
|
|
117
|
+ OP_LGS,/**< Load Far Pointer into GS */
|
|
118
|
+ OP_LEA,/**< Load Effective Address */
|
|
119
|
+ OP_LEAVE,/**< High Level Procedure Exit */
|
|
120
|
+ OP_LGDT,/**< Load Global Descript Table Register */
|
|
121
|
+ OP_LIDT,/**< Load Interrupt Descriptor Table Register */
|
|
122
|
+ OP_LLDT,/**< Load Local Descriptor Table Register */
|
|
123
|
+ OP_PREFIX_LOCK,/**< Assert LOCK# Signal Prefix */
|
|
124
|
+ OP_LODSD,/**< Load String Dword*/
|
|
125
|
+ OP_LODSW,/**< Load String Word */
|
|
126
|
+ OP_LODSB,/**< Load String Byte */
|
|
127
|
+ OP_LOOP,/**< Loop According to ECX Counter */
|
|
128
|
+ OP_LOOPE,/**< Loop According to ECX Counter and ZF=1 */
|
|
129
|
+ OP_LOOPNE,/**< Looop According to ECX Counter and ZF=0 */
|
|
130
|
+ OP_JECXZ,/**< Jump if ECX is Zero */
|
|
131
|
+ OP_LSL,/**< Load Segment Limit */
|
|
132
|
+ OP_LSS,/**< Load Far Pointer into SS */
|
|
133
|
+ OP_LTR,/**< Load Task Register */
|
|
134
|
+ OP_MOV,/**< Move */
|
|
135
|
+ OP_MOVSD,/**< Move Data from String to String Doubleword */
|
|
136
|
+ OP_MOVSW,/**< Move Data from String to String Word */
|
|
137
|
+ OP_MOVSB,/**< Move Data from String to String Byte */
|
|
138
|
+ OP_MOVSX,/**< Move with Sign-Extension */
|
|
139
|
+ OP_MOVZX,/**< Move with Zero-Extension */
|
|
140
|
+ OP_MUL,/**< Unsigned Multiply */
|
|
141
|
+ OP_NEG,/**< Two's Complement Negation */
|
|
142
|
+ OP_NOP,/**< No Operation */
|
|
143
|
+ OP_NOT,/**< One's Complement Negation */
|
|
144
|
+ OP_OR,/**< Logical Inclusive OR */
|
|
145
|
+ OP_OUT,/**< Output to Port */
|
|
146
|
+ OP_OUTSD,/**< Output String to Port Doubleword */
|
|
147
|
+ OP_OUTSW,/**< Output String to Port Word */
|
|
148
|
+ OP_OUTSB,/**< Output String to Port Bytes */
|
|
149
|
+ OP_PUSH,/**< Push Onto the Stack */
|
|
150
|
+ OP_PUSHAD,/**< Push All Double General Purpose Registers */
|
|
151
|
+ OP_PUSHA,
|
|
152
|
+ OP_PUSHFD,/**< Push EFLAGS Register onto the Stack */
|
|
153
|
+ OP_PUSHF,
|
|
154
|
+ OP_POP,/**< Pop a Value from the Stack */
|
|
155
|
+ OP_POPAD,/**< Pop All Double General Purpose Registers from the Stack */
|
|
156
|
+ OP_POPFD,/**< Pop Stack into EFLAGS Register */
|
|
157
|
+ OP_POPF,
|
|
158
|
+ OP_RCL,/**< Rotate Carry Left */
|
|
159
|
+ OP_RCR,/**< Rotate Carry Right */
|
|
160
|
+ OP_RDMSR,/**< Read from Model Specific Register */
|
|
161
|
+ OP_RDPMC,/**< Read Performance Monitoring Counters */
|
|
162
|
+ OP_RDTSC,/**< Read Time-Stamp Coutner */
|
|
163
|
+ OP_PREFIX_REPE,/**< Repeat String Operation Prefix while Equal */
|
|
164
|
+ OP_PREFIX_REPNE,/**< Repeat String Operation Prefix while Not Equal */
|
|
165
|
+ OP_RETF,/**< Return from Far Procedure */
|
|
166
|
+ OP_RETN,/**< Return from Near Procedure */
|
|
167
|
+ OP_ROL,/**< Rotate Left */
|
|
168
|
+ OP_ROR,/**< Rotate Right */
|
|
169
|
+ OP_RSM,/**< Resumse from System Management Mode */
|
|
170
|
+ OP_SAHF,/**< Store AH into Flags */
|
|
171
|
+ OP_SAR,/**< Shift Arithmetic Right */
|
|
172
|
+ OP_SBB,/**< Subtract with Borrow */
|
|
173
|
+ OP_SCASD,/**< Scan String Doubleword */
|
|
174
|
+ OP_SCASW,/**< Scan String Word */
|
|
175
|
+ OP_SCASB,/**< Scan String Byte */
|
|
176
|
+ OP_SETO,/**< Set Byte on Overflow */
|
|
177
|
+ OP_SETNO,/**< Set Byte on Not Overflow */
|
|
178
|
+ OP_SETC,/**< Set Byte on Carry */
|
|
179
|
+ OP_SETNC,/**< Set Byte on Not Carry */
|
|
180
|
+ OP_SETZ,/**< Set Byte on Zero */
|
|
181
|
+ OP_SETNZ,/**< Set Byte on Not Zero */
|
|
182
|
+ OP_SETBE,/**< Set Byte on Below or Equal */
|
|
183
|
+ OP_SETA,/**< Set Byte on Above */
|
|
184
|
+ OP_SETS,/**< Set Byte on Sign */
|
|
185
|
+ OP_SETNS,/**< Set Byte on Not Sign */
|
|
186
|
+ OP_SETP,/**< Set Byte on Parity */
|
|
187
|
+ OP_SETNP,/**< Set Byte on Not Parity */
|
|
188
|
+ OP_SETL,/**< Set Byte on Less */
|
|
189
|
+ OP_SETGE,/**< Set Byte on Greater or Equal */
|
|
190
|
+ OP_SETLE,/**< Set Byte on Less or Equal */
|
|
191
|
+ OP_SETG,/**< Set Byte on Greater */
|
|
192
|
+ OP_SGDT,/**< Store Global Descriptor Table Register */
|
|
193
|
+ OP_SIDT,/**< Store Interrupt Descriptor Table Register */
|
|
194
|
+ OP_SHL,/**< Shift Left */
|
|
195
|
+ OP_SHLD,/**< Double Precision Shift Left */
|
|
196
|
+ OP_SHR,/**< Shift Right */
|
|
197
|
+ OP_SHRD,/**< Double Precision Shift Right */
|
|
198
|
+ OP_SLDT,/**< Store Local Descriptor Table Register */
|
|
199
|
+ OP_STOSD,/**< Store String Doubleword */
|
|
200
|
+ OP_STOSW,/**< Store String Word */
|
|
201
|
+ OP_STOSB,/**< Store String Byte */
|
|
202
|
+ OP_STR,/**< Store Task Register */
|
|
203
|
+ OP_STC,/**< Set Carry Flag */
|
|
204
|
+ OP_STD,/**< Set Direction Flag */
|
|
205
|
+ OP_STI,/**< Set Interrupt Flag */
|
|
206
|
+ OP_SUB,/**< Subtract */
|
|
207
|
+ OP_SYSCALL,/**< Fast System Call */
|
|
208
|
+ OP_SYSENTER,/**< Fast System Call */
|
|
209
|
+ OP_SYSEXIT,/**< Fast Return from Fast System Call */
|
|
210
|
+ OP_SYSRET,/**< Return from Fast System Call */
|
|
211
|
+ OP_TEST,/**< Logical Compare */
|
|
212
|
+ OP_UD2,/**< Undefined Instruction */
|
|
213
|
+ OP_VERR,/**< Verify a Segment for Reading */
|
|
214
|
+ OP_VERRW,/**< Verify a Segment for Writing */
|
|
215
|
+ OP_WBINVD,/**< Write Back and Invalidate Cache */
|
|
216
|
+ OP_WRMSR,/**< Write to Model Specific Register */
|
|
217
|
+ OP_XADD,/**< Exchange and Add */
|
|
218
|
+ OP_XCHG,/**< Exchange Register/Memory with Register */
|
|
219
|
+ OP_XLAT,/**< Table Look-up Translation */
|
|
220
|
+ OP_XOR,/**< Logical Exclusive OR */
|
|
221
|
+ OP_PREFIX_OPSIZE,
|
|
222
|
+ OP_PREFIX_ADDRSIZE,
|
|
223
|
+ OP_PREFIX_SEGMENT,
|
|
224
|
+ OP_2BYTE,
|
|
225
|
+
|
|
226
|
+ OP_FPU,/**< FPU operation */
|
|
227
|
+
|
|
228
|
+ OP_F2XM1,/**< Compute 2x-1 */
|
|
229
|
+ OP_FABS,/**< Absolute Value */
|
|
230
|
+ OP_FADD,/**< Floating Point Add */
|
|
231
|
+ OP_FADDP,/**< Floating Point Add, Pop */
|
|
232
|
+ OP_FBLD,/**< Load Binary Coded Decimal */
|
|
233
|
+ OP_FBSTP,/**< Store BCD Integer and Pop */
|
|
234
|
+ OP_FCHS,/**< Change Sign */
|
|
235
|
+ OP_FCLEX,/**< Clear Exceptions */
|
|
236
|
+ OP_FCMOVB,/**< Floating Point Move on Below */
|
|
237
|
+ OP_FCMOVBE,/**< Floating Point Move on Below or Equal */
|
|
238
|
+ OP_FCMOVE,/**< Floating Point Move on Equal */
|
|
239
|
+ OP_FCMOVNB,/**< Floating Point Move on Not Below */
|
|
240
|
+ OP_FCMOVNBE,/**< Floating Point Move on Not Below or Equal */
|
|
241
|
+ OP_FCMOVNE,/**< Floating Point Move on Not Equal */
|
|
242
|
+ OP_FCMOVNU,/**< Floating Point Move on Not Unordered */
|
|
243
|
+ OP_FCMOVU,/**< Floating Point Move on Unordered */
|
|
244
|
+ OP_FCOM,/**< Compare Floating Pointer Values and Set FPU Flags */
|
|
245
|
+ OP_FCOMI,/**< Compare Floating Pointer Values and Set EFLAGS */
|
|
246
|
+ OP_FCOMIP,/**< Compare Floating Pointer Values and Set EFLAGS, Pop */
|
|
247
|
+ OP_FCOMP,/**< Compare Floating Pointer Values and Set FPU Flags, Pop */
|
|
248
|
+ OP_FCOMPP,/**< Compare Floating Pointer Values and Set FPU Flags, Pop Twice */
|
|
249
|
+ OP_FCOS,/**< Cosine */
|
|
250
|
+ OP_FDECSTP,/**< Decrement Stack Top Pointer */
|
|
251
|
+ OP_FDIV,/**< Floating Point Divide */
|
|
252
|
+ OP_FDIVP,/**< Floating Point Divide, Pop */
|
|
253
|
+ OP_FDIVR,/**< Floating Point Reverse Divide */
|
|
254
|
+ OP_FDIVRP,/**< Floating Point Reverse Divide, Pop */
|
|
255
|
+ OP_FFREE,/**< Free Floating Point Register */
|
|
256
|
+ OP_FIADD,/**< Floating Point Add */
|
|
257
|
+ OP_FICOM,/**< Compare Integer */
|
|
258
|
+ OP_FICOMP,/**< Compare Integer, Pop */
|
|
259
|
+ OP_FIDIV,/**< Floating Point Divide by Integer */
|
|
260
|
+ OP_FIDIVR,/**< Floating Point Reverse Divide by Integer */
|
|
261
|
+ OP_FILD,/**< Load Integer */
|
|
262
|
+ OP_FIMUL,/**< Floating Point Multiply with Integer */
|
|
263
|
+ OP_FINCSTP,/**< Increment Stack-Top Pointer */
|
|
264
|
+ OP_FINIT,/**< Initialize Floating-Point Unit */
|
|
265
|
+ OP_FIST,/**< Store Integer */
|
|
266
|
+ OP_FISTP,/**< Store Integer, Pop */
|
|
267
|
+ OP_FISTTP,/**< Store Integer with Truncation */
|
|
268
|
+ OP_FISUB,/**< Floating Point Integer Subtract */
|
|
269
|
+ OP_FISUBR,/**< Floating Point Reverse Integer Subtract */
|
|
270
|
+ OP_FLD,/**< Load Floating Point Value */
|
|
271
|
+ OP_FLD1,/**< Load Constant 1 */
|
|
272
|
+ OP_FLDCW,/**< Load x87 FPU Control Word */
|
|
273
|
+ OP_FLDENV,/**< Load x87 FPU Environment */
|
|
274
|
+ OP_FLDL2E,/**< Load Constant log_2(e) */
|
|
275
|
+ OP_FLDL2T,/**< Load Constant log_2(10) */
|
|
276
|
+ OP_FLDLG2,/**< Load Constant log_10(2) */
|
|
277
|
+ OP_FLDLN2,/**< Load Constant log_e(2) */
|
|
278
|
+ OP_FLDPI,/**< Load Constant PI */
|
|
279
|
+ OP_FLDZ,/**< Load Constant Zero */
|
|
280
|
+ OP_FMUL,/**< Floating Point Multiply */
|
|
281
|
+ OP_FMULP,/**< Floating Point Multiply, Pop */
|
|
282
|
+ OP_FNOP,/**< No Operation */
|
|
283
|
+ OP_FPATAN,/**< Partial Arctangent */
|
|
284
|
+ OP_FPREM,/**< Partial Remainder */
|
|
285
|
+ OP_FPREM1,/**< Partial Remainder */
|
|
286
|
+ OP_FPTAN,/**< Partial Tangent */
|
|
287
|
+ OP_FRNDINT,/**< Round to Integer */
|
|
288
|
+ OP_FRSTOR,/**< Restore x86 FPU State */
|
|
289
|
+ OP_FSCALE,/**< Scale */
|
|
290
|
+ OP_FSIN,/* Sine */
|
|
291
|
+ OP_FSINCOS,/**< Sine and Cosine */
|
|
292
|
+ OP_FSQRT,/**< Square Root */
|
|
293
|
+ OP_FSAVE,/**< Store x87 FPU State */
|
|
294
|
+ OP_FST,/**< Store Floating Point Value */
|
|
295
|
+ OP_FSTCW,/**< Store x87 FPU Control Word */
|
|
296
|
+ OP_FSTENV,/**< Store x87 FPU Environment */
|
|
297
|
+ OP_FSTP,/**< Store Floating Point Value, Pop */
|
|
298
|
+ OP_FSTSW,/**< Store x87 FPU Status Word */
|
|
299
|
+ OP_FSUB,/**< Floating Point Subtract */
|
|
300
|
+ OP_FSUBP,/**< Floating Point Subtract, Pop */
|
|
301
|
+ OP_FSUBR,/**< Floating Point Reverse Subtract */
|
|
302
|
+ OP_FSUBRP,/**< Floating Point Reverse Subtract, Pop */
|
|
303
|
+ OP_FTST,/**< Floating Point Test */
|
|
304
|
+ OP_FUCOM,/**< Floating Point Unordered Compare */
|
|
305
|
+ OP_FUCOMI,/**< Floating Point Unordered Compare with Integer */
|
|
306
|
+ OP_FUCOMIP,/**< Floating Point Unorder Compare with Integer, Pop */
|
|
307
|
+ OP_FUCOMP,/**< Floating Point Unorder Compare, Pop */
|
|
308
|
+ OP_FUCOMPP,/**< Floating Point Unorder Compare, Pop Twice */
|
|
309
|
+ OP_FXAM,/**< Examine ModR/M */
|
|
310
|
+ OP_FXCH,/**< Exchange Register Contents */
|
|
311
|
+ OP_FXTRACT,/**< Extract Exponent and Significand */
|
|
312
|
+ OP_FYL2X,/**< Compute y*log2x */
|
|
313
|
+ OP_FYL2XP1 /**< Compute y*log2(x+1) */
|
|
314
|
+};
|
|
315
|
+
|
|
316
|
+/** Access type */
|
|
317
|
+enum DIS_ACCESS {
|
|
318
|
+ ACCESS_NOARG, /** arg not present */
|
|
319
|
+ ACCESS_IMM, /** immediate */
|
|
320
|
+ ACCESS_REL, /** +/- immediate */
|
|
321
|
+ ACCESS_REG, /** register */
|
|
322
|
+ ACCESS_MEM /** [memory] */
|
|
323
|
+};
|
|
324
|
+
|
|
325
|
+/** for mem access, immediate and relative */
|
|
326
|
+enum DIS_SIZE {
|
|
327
|
+ SIZEB,/**< Byte size access */
|
|
328
|
+ SIZEW,/**< Word size access */
|
|
329
|
+ SIZED,/**< Doubleword size access */
|
|
330
|
+ SIZEF,/**< 6-byte access (seg+reg pair)*/
|
|
331
|
+ SIZEQ,/**< Quadword access */
|
|
332
|
+ SIZET,/**< 10-byte access */
|
|
333
|
+ SIZEPTR /** ptr */
|
|
334
|
+};
|
|
335
|
+
|
|
336
|
+/** X86 registers */
|
|
337
|
+enum X86REGS {
|
|
338
|
+ REG_EAX, REG_ECX, REG_EDX, REG_EBX, REG_ESP, REG_EBP, REG_ESI, REG_EDI,
|
|
339
|
+ REG_AX, REG_CX, REG_DX, REG_BX, REG_SP, REG_BP, REG_SI, REG_DI,
|
|
340
|
+ REG_AH, REG_CH, REG_DH, REG_BH, REG_AL, REG_CL, REG_DL, REG_BL,
|
|
341
|
+ REG_ES, REG_CS, REG_SS, REG_DS, REG_FS, REG_GS,
|
|
342
|
+ REG_CR0, REG_CR1, REG_CR2, REG_CR3, REG_CR4, REG_CR5, REG_CR6, REG_CR7,
|
|
343
|
+ REG_DR0, REG_DR1, REG_DR2, REG_DR3, REG_DR4, REG_DR5, REG_DR6, REG_DR7,
|
|
344
|
+ REG_ST0, REG_ST1, REG_ST2, REG_ST3, REG_ST4, REG_ST5, REG_ST6, REG_ST7,
|
|
345
|
+ REG_INVALID
|
|
346
|
+};
|
|
347
|
+
|
|
348
|
+/** disassembly result, 64-byte, matched by type-8 signatures */
|
|
349
|
+struct DISASM_RESULT {
|
|
350
|
+ uint16_t real_op;
|
|
351
|
+ uint8_t opsize;
|
|
352
|
+ uint8_t adsize;
|
|
353
|
+ uint8_t segment;
|
|
354
|
+ uint8_t arg[3][10];
|
|
355
|
+ uint8_t extra[29];
|
|
356
|
+};
|
|
357
|
+#endif
|
|
358
|
+
|