bytecode_disasm.h
Go to the documentation of this file.
00001 /*
00002  *  Copyright (C) 2009 Sourcefire, Inc.
00003  *  All rights reserved.
00004  *
00005  * Redistribution and use in source and binary forms, with or without
00006  * modification, are permitted provided that the following conditions
00007  * are met:
00008  * 1. Redistributions of source code must retain the above copyright
00009  *    notice, this list of conditions and the following disclaimer.
00010  * 2. Redistributions in binary form must reproduce the above copyright
00011  *    notice, this list of conditions and the following disclaimer in the
00012  *    documentation and/or other materials provided with the distribution.
00013  *
00014  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS AS IS'' AND
00015  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
00016  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
00017  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
00018  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
00019  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
00020  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
00021  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
00022  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
00023  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
00024  * SUCH DAMAGE.
00025  */
00026 
00027 #ifndef DISASM_BC_H
00028 #define DISASM_BC_H
00029 
00031 enum X86OPS {
00032   OP_INVALID,
00033   OP_AAA,
00034   OP_AAD,
00035   OP_AAM,
00036   OP_AAS,
00037   OP_ADD,
00038   OP_ADC,
00039   OP_AND,
00040   OP_ARPL,
00041   OP_BOUND,
00042   OP_BSF,
00043   OP_BSR,
00044   OP_BSWAP,
00045   OP_BT,
00046   OP_BTC,
00047   OP_BTR,
00048   OP_BTS,
00049   OP_CALL,
00050   OP_CDQ,
00051   OP_CWD,
00052   OP_CWDE,
00053   OP_CBW,
00054   OP_CLC,
00055   OP_CLD,
00056   OP_CLI,
00057   OP_CLTS,
00058   OP_CMC,
00059   OP_CMOVO,
00060   OP_CMOVNO,
00061   OP_CMOVC,
00062   OP_CMOVNC,
00063   OP_CMOVZ,
00064   OP_CMOVNZ,
00065   OP_CMOVBE,
00066   OP_CMOVA,
00067   OP_CMOVS,
00068   OP_CMOVNS,
00069   OP_CMOVP,
00070   OP_CMOVNP,
00071   OP_CMOVL,
00072   OP_CMOVGE,
00073   OP_CMOVLE,
00074   OP_CMOVG,
00075   OP_CMP,
00076   OP_CMPSD,
00077   OP_CMPSW,
00078   OP_CMPSB,
00079   OP_CMPXCHG,
00080   OP_CMPXCHG8B,
00081   OP_CPUID,
00082   OP_DAA,
00083   OP_DAS,
00084   OP_DEC,
00085   OP_DIV,
00086   OP_ENTER,
00087   OP_FWAIT,
00088   OP_HLT,
00089   OP_IDIV,
00090   OP_IMUL,
00091   OP_INC,
00092   OP_IN,
00093   OP_INSD,
00094   OP_INSW,
00095   OP_INSB,
00096   OP_INT,
00097   OP_INT3,
00098   OP_INTO,
00099   OP_INVD,
00100   OP_INVLPG,
00101   OP_IRET,
00102   OP_JO,
00103   OP_JNO,
00104   OP_JC,
00105   OP_JNC,
00106   OP_JZ,
00107   OP_JNZ,
00108   OP_JBE,
00109   OP_JA,
00110   OP_JS,
00111   OP_JNS,
00112   OP_JP,
00113   OP_JNP,
00114   OP_JL,
00115   OP_JGE,
00116   OP_JLE,
00117   OP_JG,
00118   OP_JMP,
00119   OP_LAHF,
00120   OP_LAR,
00121   OP_LDS,
00122   OP_LES,
00123   OP_LFS,
00124   OP_LGS,
00125   OP_LEA,
00126   OP_LEAVE,
00127   OP_LGDT,
00128   OP_LIDT,
00129   OP_LLDT,
00130   OP_PREFIX_LOCK,
00131   OP_LODSD,
00132   OP_LODSW,
00133   OP_LODSB,
00134   OP_LOOP,
00135   OP_LOOPE,
00136   OP_LOOPNE,
00137   OP_JECXZ,
00138   OP_LSL,
00139   OP_LSS,
00140   OP_LTR,
00141   OP_MOV,
00142   OP_MOVSD,
00143   OP_MOVSW,
00144   OP_MOVSB,
00145   OP_MOVSX,
00146   OP_MOVZX,
00147   OP_MUL,
00148   OP_NEG,
00149   OP_NOP,
00150   OP_NOT,
00151   OP_OR,
00152   OP_OUT,
00153   OP_OUTSD,
00154   OP_OUTSW,
00155   OP_OUTSB,
00156   OP_PUSH,
00157   OP_PUSHAD,
00158   OP_PUSHA,
00159   OP_PUSHFD,
00160   OP_PUSHF,
00161   OP_POP,
00162   OP_POPAD,
00163   OP_POPFD,
00164   OP_POPF,
00165   OP_RCL,
00166   OP_RCR,
00167   OP_RDMSR,
00168   OP_RDPMC,
00169   OP_RDTSC,
00170   OP_PREFIX_REPE,
00171   OP_PREFIX_REPNE,
00172   OP_RETF,
00173   OP_RETN,
00174   OP_ROL,
00175   OP_ROR,
00176   OP_RSM,
00177   OP_SAHF,
00178   OP_SAR,
00179   OP_SBB,
00180   OP_SCASD,
00181   OP_SCASW,
00182   OP_SCASB,
00183   OP_SETO,
00184   OP_SETNO,
00185   OP_SETC,
00186   OP_SETNC,
00187   OP_SETZ,
00188   OP_SETNZ,
00189   OP_SETBE,
00190   OP_SETA,
00191   OP_SETS,
00192   OP_SETNS,
00193   OP_SETP,
00194   OP_SETNP,
00195   OP_SETL,
00196   OP_SETGE,
00197   OP_SETLE,
00198   OP_SETG,
00199   OP_SGDT,
00200   OP_SIDT,
00201   OP_SHL,
00202   OP_SHLD,
00203   OP_SHR,
00204   OP_SHRD,
00205   OP_SLDT,
00206   OP_STOSD,
00207   OP_STOSW,
00208   OP_STOSB,
00209   OP_STR,
00210   OP_STC,
00211   OP_STD,
00212   OP_STI,
00213   OP_SUB,
00214   OP_SYSCALL,
00215   OP_SYSENTER,
00216   OP_SYSEXIT,
00217   OP_SYSRET,
00218   OP_TEST,
00219   OP_UD2,
00220   OP_VERR,
00221   OP_VERRW,
00222   OP_WBINVD,
00223   OP_WRMSR,
00224   OP_XADD,
00225   OP_XCHG,
00226   OP_XLAT,
00227   OP_XOR,
00228   OP_PREFIX_OPSIZE,
00229   OP_PREFIX_ADDRSIZE,
00230   OP_PREFIX_SEGMENT,
00231   OP_2BYTE,
00232 
00233   OP_FPU,
00235   OP_F2XM1,
00236   OP_FABS,
00237   OP_FADD,
00238   OP_FADDP,
00239   OP_FBLD,
00240   OP_FBSTP,
00241   OP_FCHS,
00242   OP_FCLEX,
00243   OP_FCMOVB,
00244   OP_FCMOVBE,
00245   OP_FCMOVE,
00246   OP_FCMOVNB,
00247   OP_FCMOVNBE,
00248   OP_FCMOVNE,
00249   OP_FCMOVNU,
00250   OP_FCMOVU,
00251   OP_FCOM,
00252   OP_FCOMI,
00253   OP_FCOMIP,
00254   OP_FCOMP,
00255   OP_FCOMPP,
00256   OP_FCOS,
00257   OP_FDECSTP,
00258   OP_FDIV,
00259   OP_FDIVP,
00260   OP_FDIVR,
00261   OP_FDIVRP,
00262   OP_FFREE,
00263   OP_FIADD,
00264   OP_FICOM,
00265   OP_FICOMP,
00266   OP_FIDIV,
00267   OP_FIDIVR,
00268   OP_FILD,
00269   OP_FIMUL,
00270   OP_FINCSTP,
00271   OP_FINIT,
00272   OP_FIST,
00273   OP_FISTP,
00274   OP_FISTTP,
00275   OP_FISUB,
00276   OP_FISUBR,
00277   OP_FLD,
00278   OP_FLD1,
00279   OP_FLDCW,
00280   OP_FLDENV,
00281   OP_FLDL2E,
00282   OP_FLDL2T,
00283   OP_FLDLG2,
00284   OP_FLDLN2,
00285   OP_FLDPI,
00286   OP_FLDZ,
00287   OP_FMUL,
00288   OP_FMULP,
00289   OP_FNOP,
00290   OP_FPATAN,
00291   OP_FPREM,
00292   OP_FPREM1,
00293   OP_FPTAN,
00294   OP_FRNDINT,
00295   OP_FRSTOR,
00296   OP_FSCALE,
00297   OP_FSIN,/* Sine */
00298   OP_FSINCOS,
00299   OP_FSQRT,
00300   OP_FSAVE,
00301   OP_FST,
00302   OP_FSTCW,
00303   OP_FSTENV,
00304   OP_FSTP,
00305   OP_FSTSW,
00306   OP_FSUB,
00307   OP_FSUBP,
00308   OP_FSUBR,
00309   OP_FSUBRP,
00310   OP_FTST,
00311   OP_FUCOM,
00312   OP_FUCOMI,
00313   OP_FUCOMIP,
00314   OP_FUCOMP,
00315   OP_FUCOMPP,
00316   OP_FXAM,
00317   OP_FXCH,
00318   OP_FXTRACT,
00319   OP_FYL2X,
00320   OP_FYL2XP1 
00321 };
00322 
00324 enum DIS_ACCESS {
00325   ACCESS_NOARG, 
00326   ACCESS_IMM,   
00327   ACCESS_REL,   
00328   ACCESS_REG,   
00329   ACCESS_MEM    
00330 };
00331 
00333 enum DIS_SIZE {
00334   SIZEB,
00335   SIZEW,
00336   SIZED,
00337   SIZEF,
00338   SIZEQ,
00339   SIZET,
00340   SIZEPTR 
00341 };
00342 
00344 enum X86REGS {
00345   REG_EAX, REG_ECX, REG_EDX, REG_EBX, REG_ESP, REG_EBP, REG_ESI, REG_EDI,
00346   REG_AX, REG_CX, REG_DX, REG_BX, REG_SP, REG_BP, REG_SI, REG_DI,
00347   REG_AH, REG_CH, REG_DH, REG_BH, REG_AL, REG_CL, REG_DL, REG_BL,
00348   REG_ES, REG_CS, REG_SS, REG_DS, REG_FS, REG_GS,
00349   REG_CR0, REG_CR1, REG_CR2, REG_CR3, REG_CR4, REG_CR5, REG_CR6, REG_CR7,
00350   REG_DR0, REG_DR1, REG_DR2, REG_DR3, REG_DR4, REG_DR5, REG_DR6, REG_DR7,
00351   REG_ST0, REG_ST1, REG_ST2, REG_ST3, REG_ST4, REG_ST5, REG_ST6, REG_ST7,
00352   REG_INVALID
00353 };
00354 
00356 struct DISASM_RESULT {
00357     uint16_t real_op;
00358     uint8_t opsize;
00359     uint8_t adsize;
00360     uint8_t segment;
00361     uint8_t arg[3][10];
00362     uint8_t extra[29];
00363 };
00364 #endif
00365 
 All Data Structures Files Functions Variables Enumerations Enumerator Defines