Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Decode offset of operand inside instruction #50

Open
BenBE opened this issue Aug 9, 2013 · 2 comments
Open

Decode offset of operand inside instruction #50

BenBE opened this issue Aug 9, 2013 · 2 comments

Comments

@BenBE
Copy link

BenBE commented Aug 9, 2013

It would be nice if there was an easy way to figure out where the lvalue information of an operand physically came from. Considering an x64 instruction like "83 3d 29 d4 20 00 00" it would be nice to get an additional field "insn_offset" or simular in each operand structure containing the offsets of each operand (2 and 6 in this case). Currently I haven't found an straight forward way to get this information without re-doing all the parsing work or guessing the offsets by pattern matching the lvalues into the byte-stream.

@BenBE
Copy link
Author

BenBE commented Aug 9, 2013

A possible patch like this untested one below should work:

diff --git a/libudis86/decode.c b/libudis86/decode.c
index a7a4896..b625c47 100644
--- a/libudis86/decode.c
+++ b/libudis86/decode.c
@@ -622,6 +622,7 @@ decode_operand(struct ud           *u,
                unsigned int         size)
 {
   operand->_oprcode = type;
+  operand->opoffset = u->inp_ctr;

   switch (type) {
     case OP_A :
diff --git a/libudis86/types.h b/libudis86/types.h
index bdfd4d9..7e32b2e 100644
--- a/libudis86/types.h
+++ b/libudis86/types.h
@@ -154,6 +154,7 @@ struct ud_operand {
   uint8_t         offset;
   union ud_lval   lval;
   uint64_t        disp;
+  uint16_t        opoffset;
   /*
    * internal use only
    */

@BenBE
Copy link
Author

BenBE commented Aug 31, 2013

There is another assignment of the current offset required after decoding the possibly optional Mod/RM byte of the instruction, before reading its actual operand value.

Example: 89 57 2a -> should result in OP1 at opoffset 2, not 1 as returned by the initial patch suggestion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant