结合Intel Manual和libdasm学习汇编指令

参考：http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html

https://code.google.com/p/libdasm/

http://nathanmarz.com/blog/you-should-blog-even-if-you-have-no-readers.html（共勉）

 

汇编指令的格式如下图所示：

参考：http://www.mouseos.com/x64/doc6.html

 

 

1. get_instruction

get_instruction函数是libdasm的核心，先看一下该函数的注释和原型

// Fetch instruction

/*
 * The operation is quite straightforward:
 *
 * - determine actual opcode (skip prefixes etc.)
 * - figure out which instruction table to use
 * - index the table with opcode
 * - parse operands
 * - fill instruction structure
 *
 * Only point where this gets hairy is those *brilliant*
 * opcode extensions....
 *
 */
int get_instruction(PINSTRUCTION inst, BYTE *addr, enum Mode mode) {

该函数分为以下几个部分：

1.1 略过prefix, 获取到实际的opcode

get_real_instruction来做这个工作。

对于单字节opcode，该函数什么也不做；

对于2字节opcode

// 2-byte opcode
        case 0x0f:
            *index += 1;
            *flags |= EXT_T2;
            break;

跳过0x0F前缀；

对于强制前缀的opcode，（Mandatory Prefix）

// Prefix group 2
        case 0x2e:
            *index += 1;
            // Clear previous flags from same group (undefined effect)
            *flags &= 0xff00ffff;
            *flags |= PREFIX_CS_OVERRIDE;
            get_real_instruction(addr + 1, index, flags);
            break;
        case 0x36:
            *index += 1;
            *flags &= 0xff00ffff;
            *flags |= PREFIX_SS_OVERRIDE;
            get_real_instruction(addr + 1, index, flags);
            break;
        case 0x3e:
            *index += 1;
            *flags &= 0xff00ffff;
            *flags |= PREFIX_DS_OVERRIDE;
            get_real_instruction(addr + 1, index, flags);
            break;
        case 0x26:
            *index += 1;
            *flags &= 0xff00ffff;
            *flags |= PREFIX_ES_OVERRIDE;
            get_real_instruction(addr + 1, index, flags);
            break;
        case 0x64:
            *index += 1;
            *flags &= 0xff00ffff;
            *flags |= PREFIX_FS_OVERRIDE;
            get_real_instruction(addr + 1, index, flags);
            break;
        case 0x65:
            *index += 1;
            *flags &= 0xff00ffff;
            *flags |= PREFIX_GS_OVERRIDE;
            get_real_instruction(addr + 1, index, flags);
            break;
        // Prefix group 3 or 3-byte opcode
        case 0x66:
            // Do not clear flags from the same group!!!!
            *index += 1;
            *flags |= PREFIX_OPERAND_SIZE_OVERRIDE;
            get_real_instruction(addr + 1, index, flags);
            break;
        // Prefix group 4
        case 0x67:
            // Do not clear flags from the same group!!!!
            *index += 1;
            *flags |=  PREFIX_ADDR_SIZE_OVERRIDE;
            get_real_instruction(addr + 1, index, flags);
            break;

设置相应的flag，然后从下一个字节取真正的opcode;

 

常见的前缀如下表所示：

1.2 确定使用哪张映射表

在opcode_tables.h中定义了几张不同和映射表

// 1-byte opcodes
INST inst_table1[256] = {

// 2-byte instructions
INST inst_table2[256] = {

// 3-byte instructions, prefix 0x66

// Yeah, I know, it's waste to use a full 256-instruction table but now
// I'm prepared for future Intel extensions ;-)

INST inst_table3_66[256] = {

// 3-byte instructions, prefix 0xf2

INST inst_table3_f2[256] = {

// 3-byte instructions, prefix 0xf3

INST inst_table3_f3[256] = {

映射表中条目的内容是对于INST结构体的描述

// struct INST is used internally by the library
typedef struct _INST {
    DWORD type;        // InstructionType type and flags
    const char *mnemonic;    // InstructionType mnemonic
    int flags1;        // First operand flags (if any)
    int flags2;        // Second operand flags (if any)
    int flags3;        // Additional operand flags (if any)
    int modrm;        // Is MODRM byte present?
    short eflags_affected;    // Processor eflags affected
    short eflags_used;      // Processor eflags used by this instruction
    int iop_written;    // mask of affected implied registers (written)
    int iop_read;        // mask of affected implied registers (read)
} INST, *PINST;

 

举一例：

{ INSTRUCTION_TYPE_ADD,    "add",       AM_E|OT_b|P_w,               AM_G|OT_b|P_r,             FLAGS_NONE,   1, EFL_MATH, 0, 0, 0 },

比较重要的字段是3-5，分别代表着参数的类型

AM_[X]代表Addressing Method，即寻址方法，通过什么方法找到参数

// Operand Addressing Methods, from the Intel manual
#define MASK_AM(x) ((x) & 0x00ff0000)
#define AM_A 0x00010000        // Direct address with segment prefix
#define AM_C 0x00020000        // MODRM reg field defines control register
#define AM_D 0x00030000        // MODRM reg field defines debug register
#define AM_E 0x00040000        // MODRM byte defines reg/memory address
#define AM_G 0x00050000        // MODRM byte defines general-purpose reg
#define AM_I 0x00060000        // Immediate data follows
#define AM_J 0x00070000        // Immediate value is relative to EIP
#define AM_M 0x00080000        // MODRM mod field can refer only to memory
#define AM_O 0x00090000        // Displacement follows (without modrm/sib)
#define AM_P 0x000a0000        // MODRM reg field defines MMX register
#define AM_Q 0x000b0000        // MODRM defines MMX register or memory
#define AM_R 0x000c0000        // MODRM mod field can only refer to register
#define AM_S 0x000d0000        // MODRM reg field defines segment register
#define AM_T 0x000e0000        // MODRM reg field defines test register
#define AM_V 0x000f0000        // MODRM reg field defines XMM register
#define AM_W 0x00100000        // MODRM defines XMM register or memory
// Extra addressing modes used in this implementation
#define AM_I1  0x00200000    // Immediate byte 1 encoded in instruction
#define AM_REG 0x00210000    // Register encoded in instruction
#define AM_IND 0x00220000    // Register indirect encoded in instruction

OT_[X]代表参数的类型Operand Type，即参数的长度

// Operand Types, from the intel manual
#define MASK_OT(x) ((x) & 0xff000000)
#define OT_a  0x01000000
#define OT_b  0x02000000    // always 1 byte
#define OT_c  0x03000000    // byte or word, depending on operand
#define OT_d  0x04000000    // double-word
#define OT_q  0x05000000    // quad-word
#define OT_dq 0x06000000    // double quad-word
#define OT_v  0x07000000    // word or double-word, depending on operand
#define OT_w  0x08000000    // always word
#define OT_p  0x09000000    // 32-bit or 48-bit pointer
#define OT_pi 0x0a000000    // quadword MMX register
#define OT_pd 0x0b000000    // 128-bit double-precision float
#define OT_ps 0x0c000000    // 128-bit single-precision float
#define OT_s  0x0d000000    // 6-byte pseudo descriptor
#define OT_sd 0x0e000000    // Scalar of 128-bit double-precision float
#define OT_ss 0x0f000000    // Scalar of 128-bit single-precision float
#define OT_si 0x10000000    // Doubleword integer register
#define OT_t  0x11000000    // 80-bit packed FP data

 

P_[X]代表参数的Permission，即参数允许的操作，也就是该条指令会对参数做什么样的操作(r, w, x)

// Operand permissions
#define MASK_PERMS(x) ((x) & 0x0000f000)
#define P_r   0x00004000    // Read
#define P_w   0x00002000    // Write
#define P_x   0x00001000    // Execute

 

1.3 映射

1.4 解析operand

Operand有三种类型：

// Operand types
enum Operand {
    OPERAND_TYPE_NONE,    // operand not present
    OPERAND_TYPE_MEMORY,    // memory operand ([eax], [0], etc.)
    OPERAND_TYPE_REGISTER,    // register operand (eax, mm0, etc.)
    OPERAND_TYPE_IMMEDIATE,    // immediate operand (0x1234)
};

 

其中，immediate是直接地址，也可以称为静态地址，即在指令中明确给出的地址；

而register和memory都是间接地址，可以称为动态地址，只有在程序真正运行时才能确定的地址。

 

即使是静态解析程序，我们也可以对于给定的内存地址，寄存器，逐条指令地模拟其内容的变化，这就是模拟器的原理，说白了，模拟器终归还属于静态解析，而算不上是真正的动态。

 

1.5 填充结构体