pyasm/x86disasm.py at master · grant-olson/pyasm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
# Copyright 2004-2010 Grant T. Olson.
# See license.txt for terms.

"""
x86disasm.py
------------

Create a disassembly dump of x86 code.

TODO: Extract x86Block as the assembler probably needs the same stuff.
"""

from x86inst import *
from x86PackUnpack import *

class x86Block:
    """
    Arbitrary block of x86 data
    """
    def __init__(self,data='',location=0x0):
        self.Data = data
        self.Location = location
        self.Labels = []
        self.LabelRefs = []

    def unpackFromString(self,f,s):
        ret = struct.unpack(f, self.Data[self.Location:self.Location+s])[0]
        self.Location += s
        return ret

    def GetUnsignedByte(self):
        return self.unpackFromString("<B",1)

    def GetUnsignedWord(self):
        return self.unpackFromString("<H",2)

    def GetWord(self):
        return self.unpackFromString("<h",2)

    def GetUnsignedDword(self):
        return self.unpackFromString("<L",4)

    def GetString(self, length):
        return self.unpackFromString("<%ds" % length, length)

class x86Disassembler:
    def __init__(self,code,addr=0x40000000):
        self.Code = code
        self.Address = addr

    def disasm(self):
        while self.Code.Data[self.Code.Location:]:
            op = []
            op.append(self.Code.GetUnsignedByte())
            try:
                while 1:
                    try:
                        inst = opcodeDict.GetOp(tuple(op))
                        break
                    except OpcodeNeedsModRM:
                        modRM = struct.unpack("<B", self.Code.Data[self.Code.Location])[0]
                        inst = opcodeDict.GetOp(tuple(op),
                                                modRM=modRM)
                        break
                    except OpcodeTooShort:
                        op.append(self.Code.GetUnsignedByte())
            except KeyError,x:
                raise RuntimeError("Unsupported Opcode '%s'" % op)
            instInst = inst.GetInstance()
            try:
                suffixSize = instInst.GetSuffixSize()
            except OpcodeNeedsModRM,x:
                modRM = struct.unpack("<B", self.Code.Data[self.Code.Location])[0]
                suffixSize = instInst.GetSuffixSize(modRM)
            instInst.LoadData(self.Code.GetString(suffixSize))
            instInst.Address = self.Address
            print instInst.OpText()
            self.Address += instInst.GetInstructionSize()