Legal part
Introduction
Brief description of functions
Assemble
Checkcondition
Decodeaddress
Disasm
Disassembleback
Disassembleforward
Isfilling
Printfloat* functions

This package includes source code of 32-bit Disassembler and 32-bit single line Assembler for 80x86-compatible processors. The source is a slightly stripped version of code used in OllyDbg v1.04 and is well proven by its numerous users. (If you haven't heard before, OllyDbg is a 32-bit Assembler level debugger with powerful analyzing capabilities that makes binary machine code understandable).

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License (http://www.fsf.org/copyleft/gpl.html) for more details.

You should have received a copy of the GNU General Public License (gpl.txt) along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA.

All brand names and product names used in 80x86 Assembler and Disassembler, accompanying files or in this help file are trademarks, registered trademarks, or trade names of their respective holders.
 

Disassembler understands all standard 80x86 commands, FPU, MMX, AMD's MMX extensions, Athlon/PIII MMX extensions and 3DNow! instructions. It does not decode SSI or SSI2 commands. Disassembler assumes 32 bit code and data segments but correctly decodes prefixed 16-bit commands. Several decoding modes allow you to select the amount of returned information (which is inversely proportional to execution speed): command length only, basic information useful for code analysis, or full decoding with dump and assembler form. Multiple options select desired format. Disassembler and Assembler support both MASM and Borland's IDEAL modes.

Assembler converts single command from the ASCII form to the binary code. It allows to find several possible encodings, or even to create search patterns with undefined operands.

This package includes following files:

• disasm.h - common definitions
• disasm.c - Disassembler
• assembl.c - Assembler
• asmserv.c - table of commands and service functions
• main.c - demo program

    #define MAINPROG // Place all unique variables here
    #include "disasm.h"

(I use this trick to define shared global variables). Below is a small piece of code disassembled with OllyDbg 1.04 using different text settings:
 

004505B3  A1 DC464B00         MOV EAX,DS:[4B46DC] 004505B8  8B0498              MOV EAX,DS:[EAX+EBX*4] 004505BB  50                  PUSH EAX 004505BC  8D85 E0FBFFFF       LEA EAX,SS:[EBP-420] 004505C2  50                  PUSH EAX 004505C3  E8 141BFCFF         CALL 004120DC  004505C8  83C4 08             ADD ESP,8 004505CB  43                  INC EBX 004505CC  3B1D D8464B00       CMP EBX,DS:[4B46D8] 004505D2  0F8C AFFEFFFF       JL 00450487  004505D8  80BD E0FDFFFF 00    CMP BYTE PTR SS:[EBP-220],0 004505DF  75 14               JNZ SHORT 004505F5 004505E1  68 B39E4600         PUSH 469EB3  004505E6  8D85 E0FDFFFF       LEA EAX,SS:[EBP-220] 004505EC  50                  PUSH EAX 004505ED  E8 521BFCFF         CALL 00412144

 

004505B3  A1 DC464B00         mov     eax,[dword ds:4B46DC] 004505B8  8B0498              mov     eax,[dword ds:eax+ebx*4] 004505BB  50                  push    eax 004505BC  8D85 E0FBFFFF       lea     eax,[dword ss:ebp-420] 004505C2  50                  push    eax 004505C3  E8 141BFCFF         call    004120DC 004505C8  83C4 08             add     esp,8 004505CB  43                  inc     ebx 004505CC  3B1D D8464B00       cmp     ebx,[dword ds:4B46D8] 004505D2  0F8C AFFEFFFF       jl      00450487 004505D8  80BD E0FDFFFF 00    cmp     [byte ss:ebp-220],0 004505DF  75 14               jnz     short 004505F5 004505E1  68 B39E4600         push    469EB3 004505E6  8D85 E0FDFFFF       lea     eax,[dword ss:ebp-220] 004505EC  50                  push    eax 004505ED  E8 521BFCFF         call    00412144

• int Assemble(char *cmd,ulong ip,t_asmmodel *model,int attempt,int constsize,char *errtext) - assembles text command to binary code;
• int Checkcondition(int code,ulong flags) - checks whether flags met condition in the command;
• int Decodeaddress(ulong addr,ulong base,int addrmode,char *symb,int nsymb,char *comment) - user-supplied function that decodes addresses into symbolic names;
• ulong Disasm(char *src,ulong srcsize,ulong srcip,t_disasm *disasm,int disasmmode) - determines length of the binary command or disassembles it to the text;
• ulong Disassembleback(char *block,ulong base,ulong size,ulong ip,int n) - walks binary code backward;
• ulong Disassembleforward(char *block,ulong base,ulong size,ulong ip,int n) - walks binary code forward;
• int Isfilling(ulong addr,char *data,ulong size,ulong align) - determines whether command is equivalent to NOP;
• int Print3dnow(char *s,char *f) - converts 3DNow! constant to text without triggering FPU exception for invalid operands;
• int Printfloat10(char *s,long double ext) - converts 10-byte floating constant to text without causing exception;
• int Printfloat4(char *s,float f) - converts 4-byte floating constant to text without causing exception;
• int Printfloat8(char *s,double d) - converts 8-byte floating constant to text without causing exception.

Function Assemble(), as expected, converts command from ASCII form to binary 32 bit code. It shares command table with Disasm(), so if some command can be disassembled, it can be assembled back too, with one exception: Assemble doesn't support 16 bit addresses. With some unimportant exceptions, 16 bit addresses cannot be used in Win32 programs.

Some commands have more than one encoding. Assemble() allows you to find them all. This is important, for example, if you want to find the shortest possible code or to find all possible occurrences of this command in the code. There are two parameters, constsize and attempt. First parameter selects size of immediate constant and address constant (8 or 32 bits), second is the occurrence of the command in the command table. To find all variants, call Assemble() with attempt=0,1,2... and for each attempt with constsize=0,1,2,3 as long as function reports success for at least one constsize. Generated codes may repeat. Please note that if command uses memory addresses, only one form will be generated in each case: [EAX*2] but not [EAX+EAX]; [EBX+EAX] but not [EAX+EBX]; [EAX] will not use SIB byte; no DS: prefix and so on.

Assemble compiles also imprecise commands that include following generalized operands:

• R8 - any 8-bit register (stays for AL, BL, CL, DL, AH, BH, CH, DH)
• R16 - any 16 bit register (AX, BX, CX, DX, SP, BP, SI, DI)
• R32 - any 32 bit register (EAX, EBX, ECX, EDX, ESP, EBP, ESI, EDI)
• FPU - any FPU register (ST0..ST7)
• MMX - any MMX register (MM0..MM7)
• CRX - any control register (CR0..CR7)
• DRX - any debug register (DR0..DR7)
• CONST - any constant

Function returns number of bytes in assembled code or non-positive (zero or negative) number in case of error or when variant selected by combination of attempt and constsize doesn't exist. This number is the negative position of error in the input command. If you generate executable code, imprecise commands are usually not allowed. To assure that command is precise, check that all significant bytes in mask contain 0xFF.

int Assemble(char *cmd,ulong ip,t_asmmodel *model,int attempt,int constsize,char *errtext);

Parameters:

• cmd - pointer to zero terminated ASCII command;
• pi - address of the first byte of generated binary command in memory;
• model - pointer to the structure that receives machine code and mask, see detailed description below;
• attempt - index of alternative encoding of the command. Call Assemble with attempt=0,1,2... to obtain all possible versions of the command. Stop this sequence when Assemble reports error;
• constsize - requested size of address constant and immediate data. Call Assemble with constsize=0,1,2,3 to obtain all possible encodings of the version selected by attempt;
• errtext - pointer to text buffer of length at least TEXTLEN bytes that receives description of detected error.

typedef struct t_asmmodel {    // Model to search for assembler command
    char code[MAXCMDSIZE];     // Binary code
    char mask[MAXCMDSIZE];     // Mask for binary code (0: bit ignored)
    int length;                // Length of code, bytes (0: empty)
    int jmpsize;               // Offset size if relative jump
    int jmpoffset;             // Offset relative to IP
    int jmppos;                // Position of jump offset in command
} t_asmmodel;

Members:

• code - binary code of the command. Only bits that have 1's in corresponding mask bits are significant;
• mask - comparison mask. Search routine ignores all code bits where mask is set to 0;
• length - length of code and mask, bytes. If length is 0, search model is empty or invalid;
• jmpsize - if nonzero, command is a relative jump and jmpsize is a size of offset in bytes;
• jmpoffset - if jmpsize is nonzero, jump offset relative to address of the following command, otherwise undefined;
• jmppos - if jmpsize is nonzero, position of the first byte of the offset in code, otherwise undefined.

Checks whether 80x86 flags meet condition code in the command. Returns 1 if condition is met and 0 if not.

int Checkcondition(int code,ulong flags);

Parameters:

• code - byte of command that contains condition code;
• flags - contents of register EFL.

Custom user-supplied function that converts constant (address) into symbolic name. Initially, source code includes dummy function that returns 0.

Decodeaddress() decodes memory address or constant to the ASCII string and optionally comments this address. Returns length of decoded string (not including terminal 0), or 0 on error or if symbolic name is not available.

int Decodeaddress(ulong addr,char *symb,int nsymb,char *comment);

Parameters:

• addr - address to decode in address space of debugged program;
• symb - pointer to buffer of length at least nsymb bytes where Decodeaddress() places decoded string;
• nsymb - length, in characters, of buffer symb;
• comment - pointer to string of length at least TEXTLEN bytes or NULL, receives comment associated with addr.

The most important (and complex) function in this package. Depending on the specified disasmmode, Disasm() performs one of the four functions:

• DISASM_SIZE - quickly determines size of the command. Use this mode if you want to walk through the code. In this mode, treat all members of disasm as undefined;
• DISASM_DATA - determines size and analyses operands. Use this mode for quick analysis, for example, if you need to calculate jump destination. Members of disasm marked with asterisk (*) are undefined;
• DISASM_FILE - determines size, analyses operand and disassembles command, but doesn't attempt to convert addresses to symbols. Use this mode if there is no correspondence between addresses and symbols, for example, if you dump the contents of binary file;
• DISASM_CODE - full disassembly.

ulong Disasm(char *src,ulong srcsize,ulong srcip,t_disasm *disasm,int disasmmode);

Parameters:

• src - pointer to binary code that must be disassembled;
• srcsize - size of src. Length of 80x86 command is limited to MAXCMDSIZE bytes;
• srcip - address of the command;
• disasm - pointer to structure that receives results of disassembling, see detailed description below;
• disasmmode - disassembly mode, one of DISASM_xxx (see above).

typedef struct t_disasm {     // Results of disassembling
    ulong pi;                 // Instruction pointer
    char dump[TEXTLEN];       // (*) Hexadecimal dump of the command
    char result[TEXTLEN];     // (*) Disassembled command
    char comment[TEXTLEN];    // (*) Brief comment
    int cmdtype;              // One of C_xxx
    int memtype;              // Type of addressed variable in memory
    int nprefix;              // Number of prefixes
    int indexed;              // Address contains register(s)
    ulong jmpconst;           // Constant jump address
    ulong jmptable;           // Possible address of switch table
    ulong adrconst;           // Constant part of address
    ulong immconst;           // Immediate constant
    int zeroconst;            // Whether contains zero constant
    int fixupoffset;          // Possible offset of 32 bit fixups
    int fixupsize;            // Possible total size of fixups or 0
    int error;                // Error while disassembling command
    int warnings;             // Combination of DAW_xxx
} t_disasm;

Members:

• pi - address of the disassembled command;
• dump - ASCII string, formatted hexadecimal dump of the command;
• result - ASCII string, disassembled command itself;
• comment - ASCII string, brief comment that applies to the whole command;
• cmdtype - type of the disassembled command, one of C_xxx possibly ORed with C_RARE to indicate that command is seldom in ordinary Win32 applications. Commands of type C_MMX additionally contain size of MMX data in the 3 least significant bits (0 means 8-byte operands). Non-MMX commands may have C_EXPL bit set which means that some memory operand has size which is not conform with standard 80x86 rules;
• memtype - type of memory operand, one of DEC_xxx, or DEC_UNKNOWN if operand is non-standard or command does not access memory;
• nprefix - number of prefixes that this command contains;
• indexed - if memory address contains index register, set to scale, otherwise 0;
• jmpconst - address of jump destination if this address is a constant, and 0 otherwise;
• jmptable - if indirect jump can be interpreted as switch, base address of switch table and 0 otherwise;
• adrconst - constant part of memory address;
• immconst - immediate constant or 0 if command contains no immediate constant. The only command that contains two immediate constants is ENTER. Disasm() ignores second constant which is anyway 0 in most cases;
• zeroconst - nonzero if command contains immediate zero constant;
• fixupoffset - possible start of 32 bit fixup within the command, or 0 if command can't contain fixups;
• fixupsize - possible total size of fixups (0, 4 or 8). If command contains both immediate constant and immediate address, they are always adjacent on 80x86 processors;
• error - Disasm() was unable to disassemble command (for example, command does not exist or crosses end of memory block), one of DAE_xxx;
• warnings - command is suspicious or meaningless (for example, far jump or MOV EAX,EAX preceded with segment prefix), combination of DAW_xxx bits;

• ideal - force IDEAL decoding mode
• lowercase - force lowercase
• tabarguments - insert tab between mnemonic and arguments
• extraspace - insert extra space between arguments
• putdefseg - show default segments
• showmemsize - always show memory size
• shownear - show NEAR modifiers
• shortstringcmds - use short form of string commands
• sizesens - mode of decoding of size-sensitive mnemonics (16/32 bits) like:

• symbolic - show symbolic addresses, requires Decodeaddress()

• farcalls - accept far calls, returns & addresses
• decodevxd - decode VxD calls (Win95/98)
• privileged - accept privileged commands
• iocommand - accept I/O commands
• badshift - accept shift out of range 1..31
• extraprefix - accept superfluous prefixes
• lockedbus - accept LOCK prefixes
• stackalign - accept unaligned stack operations
• iswindowsnt - when checking for dangerous commands, assume NT-based OS

Calculates address of assembler instruction that is n instructions (maximally 127) back from the instruction at specified pi. Returns address of found instruction. In case of error, it may be less than n instructions apart.

80x86 commands have variable length. Disassembleback uses heuristical methods to separate commands and in some (astoundingly rare!) cases may return invalid answer.

ulong Disassembleback(char *block,ulong base,ulong size,ulong ip,int n);

Parameters:

• block - pointer to the copy of code;
• base - address of first byte in the code block;
• size - size of code block;
• pi - address of current instruction;
• n - number of instructions to walk back.

Calculates address of assembler instruction that is n instructions forward from instruction at specified address. Returns address of found instruction. In case of error, it may be less than n instructions apart.

ulong Disassembleforward(char *block,ulong base,ulong size,ulong ip,int n,int usedec);

Parameters:

• block - pointer to the copy of code;
• base - address of first byte in the code block;
• size - size of code block;
• pi - address of current instruction;
• n - number of instructions to walk forward.

Function determines whether pointed instruction is a no-action command (equivalent to NOP) used by different compilers to fill the gap between procedures or data blocks to a specified aligned border. Returns length of filling command in bytes or 0 if command is not a recognized filling.

int Isfilling(ulong addr,char *data,ulong size,ulong align);

Parameters:

• addr - address of the first byte of analyzed command;
• data - pointer to the binary command;
• size - size of data;
• align - assumed alignment of the next non-filling command (power of 2), or 0 if alignment is not required.

These functions decode 4-, 8-, 10-byte floating point number or 8-byte 3DNow! operand into the text form to string s. They correctly decode all cases of NANs or INFs without triggering floating point exceptions. If operand is not a valid floating point number, functions print hexadecimal dump of the number. Return length of decoded string in bytes, not including terminal 0.

int Print3dnow(char *s,char *f);
int Printfloat10(char *s,long double ext);
int Printfloat4(char *s,float f);
int Printfloat8(char *s,double d);
 
 

Copyleft (C) 2001 Oleh Yuschuk