Announcement

Collapse

Forum Guidelines

This forum is for finished source code that is working properly. If you have questions about this or any other source code, please post it in one of the Discussion Forums, not here.
See more
See less

LDE32 - x86 Length Disassembly Engine

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • LDE32 - x86 Length Disassembly Engine

    LDE32 is a simple length disassembly engine written by virus author z0mbie. You simply give it a chunk of code and it breaks the code down into its individual instructions, allowing you to determine the length of each instruction. It seems to work fine on the standard x86 instruction set but I dont believe it has any support for extended instructions like MMX.

    The following example disassembles this code, which is the start of a Powerbasic function ...
    00403D30 . 55
    00403D31 . 8BEC
    00403D33 . 53
    00403D34 . 56
    00403D35 . 57
    00403D36 . BB 00804000
    00403D3B . 66:2E:F705 60454000 0400
    00403D45 . 0F85 08010000
    00403D4B . 6A 00

    So I've simply defined it as ...
    sCode = CHR$(&h55,&h8B,&hEC,&h53,&h56,&h57,&hBB,&h00,&h80,&h40,&h00,&h66,&h2E,&hF7,&h05,&h60,&h45,&h40,&h00,&h04,&h00,&h0F,&h85,&h08,&h01,&h0,&h0,&h6A,&h00)

    Here is the resulting output after parsing it through LDE32 ...
    00143D44: 55 (Len: 1)
    00143D45: 8B (Len: 2)
    00143D47: 53 (Len: 1)
    00143D48: 56 (Len: 1)
    00143D49: 57 (Len: 1)
    00143D4A: BB (Len: 5)
    00143D4F: 66 (Len: 10)
    00143D59: 0F (Len: 6)
    00143D5F: 6A (Len: 2)



    LDE32.BAS:
    Code:
    #COMPILE EXE
    #INCLUDE "win32api.inc"
     
    GLOBAL sTable AS STRING * 2049, ptrTable AS DWORD
     
    %MAX_INSTRUCTIONS = 8   '// Maximum number of instructions to disassemble
     
    FUNCTION PBMAIN() AS LONG
    #REGISTER NONE
    DIM sCode AS STRING, ptrCode AS DWORD, ptrTable AS DWORD, result AS LONG, CurPos AS LONG, Instructions AS LONG
     
    '// Code to disassemble
    sCode = CHR$(&h55,&h8B,&hEC,&h53,&h56,&h57,&hBB,&h00,&h80,&h40,&h00,&h66,&h2E,&hF7,&h05,&h60,&h45,&h40,&h00,&h04,&h00,&h0F,&h85,&h08,&h01,&h0,&h0,&h6A,&h00)
     
    ptrCode  = STRPTR(sCode): ptrTable = VARPTR(sTable)
     
    ! push ptrTable           ; build disasm flag tables
    ! call disasm_init
    ! mov ebx, ptrCode        ; &h401000
    cycle:
    ! mov CurPos, ebx
    ! push    ebx             ; disasm offset
    ! push    ptrTable        ; internal disasm table
    ! call    disasm_main
    ! mov     result, eax
    ! push ebx
    ! push eax
    IF result = -1 THEN GOTO EndOfDisasm
    STDOUT HEX$(CurPos,8) & ": " & HEX$(ASC(MID$(sCode, CurPos - ptrCode + 1, 1)),2) & " (Len: " & STR$(result) & ")"
    ! pop eax
    ! pop ebx
    ! add ebx, eax
    ! inc Instructions
    ! cmp Instructions, %MAX_INSTRUCTIONS
    ! jng cycle
    EndOfDisasm:
     
    STDOUT "DONE": WAITKEY$
    EXIT FUNCTION
    disasm_init:
    ! db &h0C8,&h000,&h000,&h000,&h060,&h08B,&h07D,&h008
    ! db &h0FC,&h0E8,&h005,&h000,&h000,&h000,&h061,&h0C9
    ! db &h0C2,&h004,&h000,&h033,&h0C0,&h050,&h050,&h050
    ! db &h068,&h000,&h0A8,&h0AA,&h002,&h068,&h07F,&h068
    ! db &h0FF,&h03F,&h068,&h0A0,&h0DE,&h0E6,&h0FF,&h068
    ! db &h0FF,&h0FF,&h0D5,&h0DB,&h068,&h0AA,&h0AA,&h0FE
    ! db &h0FF,&h068,&h0AA,&h0AA,&h0AA,&h0AA,&h068,&h000
    ! db &h000,&h0AA,&h0AA,&h050,&h050,&h050,&h050,&h050
    ! db &h050,&h068,&h054,&h001,&h000,&h000,&h068,&h055
    ! db &h0F5,&h0FF,&h041,&h068,&h0AA,&h0DD,&h0DE,&h055
    ! db &h068,&h011,&h051,&h095,&h019,&h068,&h0FF,&h01F
    ! db &h011,&h011,&h068,&h0AA,&h0FF,&h011,&h0FA,&h068
    ! db &h096,&h0CF,&h060,&h08E,&h068,&h0AA,&h0D6,&h072
    ! db &h0FC,&h068,&h088,&h0AA,&h0AA,&h0AA,&h068,&h0D5
    ! db &h088,&h088,&h088,&h068,&h09B,&h055,&h08D,&h052
    ! db &h068,&h053,&h0D5,&h06C,&h036,&h068,&h0FF,&h055
    ! db &h055,&h035,&h068,&h0F9,&h0D6,&h0FE,&h0FF,&h068
    ! db &h088,&h088,&h088,&h068,&h068,&h088,&h088,&h088
    ! db &h088,&h068,&h0CA,&h047,&h053,&h08D,&h068,&h0DF
    ! db &h07B,&h0C6,&h0DC,&h068,&h0AA,&h0AA,&h0AA,&h0AA
    ! db &h068,&h0AA,&h0AA,&h0AA,&h0AA,&h068,&h0FD,&h04F
    ! db &h0A9,&h0AB,&h068,&h0EA,&h0FE,&h0A7,&h0D4,&h068
    ! db &h029,&h075,&h0FF,&h053,&h068,&h0FE,&h0A7,&h0A4
    ! db &h0FF,&h068,&h04A,&h0FA,&h09F,&h092,&h068,&h0FF
    ! db &h029,&h0E9,&h07F,&h0B9,&h000,&h002,&h000,&h000
    ! db &h033,&h0DB,&h0E8,&h013,&h000,&h000,&h000,&h0AB
    ! db &h0E2,&h0F8,&h0C3,&h00B,&h0DB,&h075,&h007,&h058
    ! db &h05E,&h05A,&h056,&h050,&h0B3,&h020,&h04B,&h0D1
    ! db &h0EA,&h0C3,&h0E8,&h0EC,&h0FF,&h0FF,&h0FF,&h00F
    ! db &h083,&h0A2,&h000,&h000,&h000,&h0E8,&h0E1,&h0FF
    ! db &h0FF,&h0FF,&h073,&h006,&h0B8,&h000,&h008,&h000
    ! db &h000,&h0C3,&h0E8,&h0D4,&h0FF,&h0FF,&h0FF,&h072
    ! db &h06E,&h0E8,&h0CD,&h0FF,&h0FF,&h0FF,&h073,&h061
    ! db &h0E8,&h0C6,&h0FF,&h0FF,&h0FF,&h073,&h054,&h0E8
    ! db &h0BF,&h0FF,&h0FF,&h0FF,&h072,&h02D,&h0E8,&h0B8
    ! db &h0FF,&h0FF,&h0FF,&h073,&h006,&h0B8,&h080,&h000
    ! db &h000,&h000,&h0C3,&h0E8,&h0AB,&h0FF,&h0FF,&h0FF
    ! db &h073,&h006,&h0B8,&h008,&h002,&h000,&h000,&h0C3
    ! db &h0E8,&h09E,&h0FF,&h0FF,&h0FF,&h073,&h006,&h0B8
    ! db &h003,&h000,&h000,&h000,&h0C3,&h0B8,&h030,&h000
    ! db &h000,&h000,&h0C3,&h0E8,&h08B,&h0FF,&h0FF,&h0FF
    ! db &h073,&h006,&h0B8,&h008,&h008,&h000,&h000,&h0C3
    ! db &h0E8,&h07E,&h0FF,&h0FF,&h0FF,&h073,&h006,&h0B8
    ! db &h005,&h000,&h000,&h000,&h0C3,&h0B8,&h020,&h000
    ! db &h000,&h000,&h0C3,&h0B8,&h000,&h010,&h000,&h000
    ! db &h0C3,&h0B8,&h010,&h000,&h000,&h000,&h0C3,&h0E8
    ! db &h05F,&h0FF,&h0FF,&h0FF,&h073,&h013,&h0E8,&h058
    ! db &h0FF,&h0FF,&h0FF,&h073,&h006,&h0B8,&h001,&h000
    ! db &h000,&h000,&h0C3,&h0B8,&h010,&h008,&h000,&h000
    ! db &h0C3,&h0B8,&h008,&h000,&h000,&h000,&h0C3,&h0E8
    ! db &h03F,&h0FF,&h0FF,&h0FF,&h072,&h006,&h0B8,&h0FF
    ! db &h0FF,&h0FF,&h0FF,&h0C3,&h0B8,&h000,&h000,&h000
    ! db &h000,&h0C3
    disasm_main:
    ! db &h0C8,&h000,&h000,&h000,&h060,&h08B,&h075,&h00C
    ! db &h0FC,&h033,&h0DB,&h033,&h0C0,&h0AC,&h08B,&h04D
    ! db &h008,&h00B,&h01C,&h081,&h03C,&h0F6,&h074,&h004
    ! db &h03C,&h0F7,&h075,&h011,&h081,&h0CB,&h000,&h008
    ! db &h000,&h000,&h0F6,&h006,&h038,&h075,&h006,&h081
    ! db &h0CB,&h000,&h018,&h000,&h000,&h03C,&h0CD,&h075
    ! db &h00B,&h083,&h0CB,&h010,&h080,&h03E,&h020,&h075
    ! db &h003,&h083,&h0CB,&h040,&h03C,&h00F,&h075,&h008
    ! db &h0AC,&h00B,&h09C,&h081,&h000,&h004,&h000,&h000
    ! db &h083,&h0FB,&h0FF,&h075,&h009,&h089,&h05C,&h024
    ! db &h01C,&h0E9,&h0F0,&h000,&h000,&h000,&h0F7,&h0C3
    ! db &h001,&h000,&h000,&h000,&h074,&h005,&h083,&h0F3
    ! db &h001,&h0EB,&h0A8,&h0F7,&h0C3,&h000,&h010,&h000
    ! db &h000,&h074,&h00A,&h083,&h0F3,&h008,&h0A8,&h001
    ! db &h075,&h003,&h083,&h0F3,&h018,&h0F7,&h0C3,&h000
    ! db &h008,&h000,&h000,&h074,&h058,&h0AC,&h08A,&h0E8
    ! db &h08A,&h0C8,&h066,&h081,&h0E1,&h007,&h0C0,&h080
    ! db &h0FD,&h0C0,&h074,&h049,&h0F7,&h0C3,&h004,&h000
    ! db &h000,&h000,&h074,&h018,&h066,&h083,&h0F9,&h006
    ! db &h074,&h00A,&h080,&h0FD,&h040,&h074,&h01D,&h080
    ! db &h0FD,&h080,&h075,&h031,&h081,&h0CB,&h000,&h002
    ! db &h000,&h000,&h0EB,&h029,&h080,&h0F9,&h004,&h075
    ! db &h006,&h08A,&h00E,&h046,&h080,&h0E1,&h007,&h080
    ! db &h0FD,&h040,&h075,&h008,&h081,&h0CB,&h000,&h001
    ! db &h000,&h000,&h0EB,&h011,&h080,&h0FD,&h080,&h074
    ! db &h006,&h066,&h083,&h0F9,&h005,&h075,&h006,&h081
    ! db &h0CB,&h000,&h004,&h000,&h000,&h0F7,&h0C3,&h080
    ! db &h000,&h000,&h000,&h074,&h014,&h081,&h0F3,&h000
    ! db &h002,&h000,&h000,&h0F7,&h0C3,&h004,&h000,&h000
    ! db &h000,&h075,&h006,&h081,&h0F3,&h000,&h006,&h000
    ! db &h000,&h0F7,&h0C3,&h008,&h000,&h000,&h000,&h074
    ! db &h00E,&h083,&h0F3,&h020,&h0F7,&h0C3,&h002,&h000
    ! db &h000,&h000,&h075,&h003,&h083,&h0F3,&h060,&h0F7
    ! db &h0C3,&h000,&h001,&h000,&h000,&h074,&h001,&h0AC
    ! db &h0F7,&h0C3,&h000,&h002,&h000,&h000,&h074,&h002
    ! db &h066,&h0AD,&h0F7,&h0C3,&h000,&h004,&h000,&h000
    ! db &h074,&h001,&h0AD,&h0F7,&h0C3,&h010,&h000,&h000
    ! db &h000,&h074,&h001,&h0AC,&h0F7,&h0C3,&h020,&h000
    ! db &h000,&h000,&h074,&h002,&h066,&h0AD,&h0F7,&h0C3
    ! db &h040,&h000,&h000,&h000,&h074,&h001,&h0AD,&h02B
    ! db &h075,&h00C,&h089,&h074,&h024,&h01C,&h061,&h0C9
    ! db &h0C2,&h008,&h000
    END FUNCTION
    Last edited by Wayne Diamond; 1 Jul 2008, 10:26 PM.
    -

  • #2
    ^ NOTE: This above 2008 LDE32 x86-only demo is now obsolete
    (ok not obsolete, but superseded - LDE32 still works for x86 pretty well, but I'd recommend switching over) ...

    I've uploaded a new 2014 demo (LDE64) which uses a newer and different instruction-length disassembly engine written by a different author, and it also supports 64-bit instructions. (It's also even a bit easier to use)

    LDE64 - http://www.powerbasic.com/support/pb...ad.php?t=57999
    Last edited by Wayne Diamond; 23 Aug 2014, 06:36 AM.
    -

    Comment

    Working...
    X