library/src/decoders/x86ASM/BP-x86InstDecode.cc
// Retreives a SIB encoded string reflecting an encoded rm value. Operand
// is un-needed because operands are 32 bit only in SIB encodes.
Retreives a SIB encoded string reflecting an encoded rm value. Operand
is un-needed because operands are 32 bit only in SIB encodes.
Retreives a SIB encoded string reflecting an encoded rm value . Operand is un - needed because operands are 32 bit only in SIB encodes .
char * X86_32_GetRmSibString(P_X86_32_DECODED_INSTRUCTION_LIST partialDecode){
	size_t scale = IA32_SIB_GET_SCALE(partialDecode->sib);
	size_t index = IA32_SIB_GET_INDEX(partialDecode->sib);
	size_t base  = IA32_SIB_GET_BASE (partialDecode->sib);
	char sibStr[200];
	memset(sibStr, 0x00, 200);
	switch(base){
		case 0x00:
			strncat(sibStr, "[EAX", 5);
			break;
		case 0x01:
			strncat(sibStr, "[ECX", 5);
				break;
		case 0x02:
			strncat(sibStr, "[EDX", 5);
				break;
		case 0x03:
			strncat(sibStr, "[EBX", 5);
				break;
		case 0x04:
			strncat(sibStr, "[ESP", 5);
				break;
		case 0x05:
			break;
		case 0x06:
			strncat(sibStr, "[ESI", 5);
				break;
		case 0x07:
			strncat(sibStr, "[EDI", 5);
				break;
		default:
			break;
	}
	if(strlen(sibStr) != 1){
		strncat(sibStr, " + ", 3);
	}
	switch(scale){
		case 0x00:
			switch(index){
				case 0x00:
					strncat(sibStr, "EAX]", 7);
					return bpstrndup(sibStr, 100);
				case 0x08:
					strncat(sibStr, "ECX]", 7);
					return bpstrndup(sibStr, 100);
				case 0x10:
					strncat(sibStr, "EDX]", 7);
					return bpstrndup(sibStr, 100);
				case 0x18:
					strncat(sibStr, "EBX]", 7);
					return bpstrndup(sibStr, 100);
				 Empty Set
				case 0x20:
					memset(&sibStr[strlen(sibStr)-3], 0x00, 3);
					strncat(sibStr, "]", 7);
					return bpstrndup(sibStr, 100);
				case 0x28:
					strncat(sibStr, "EBP]", 7);
					return bpstrndup(sibStr, 100);
				case 0x30:
					strncat(sibStr, "ESI]", 7);
					return bpstrndup(sibStr, 100);
				case 0x38:
					strncat(sibStr, "EDI]", 7);
					return bpstrndup(sibStr, 100);
			}
			break;
		 Scale Row 1
		case 0x40:
			switch(index){
				case 0x00:
					strncat(sibStr, "EAX * 2]", 15);
					return bpstrndup(sibStr, 100);
				case 0x08:
					strncat(sibStr, "ECX * 2]", 15);
					return bpstrndup(sibStr, 100);
				case 0x10:
					strncat(sibStr, "EDX * 2]", 15);
					return bpstrndup(sibStr, 100);
				case 0x18:
					strncat(sibStr, "EBX * 2]", 15);
					return bpstrndup(sibStr, 100);
				 Empty Set
				case 0x20:
					memset(&sibStr[strlen(sibStr)-3], 0x00, 3);
					strncat(sibStr, "]", 7);
					return bpstrndup(sibStr, 100);
				case 0x28:
					strncat(sibStr, " EBP * 2]", 15);
					return bpstrndup(sibStr, 100);
				case 0x30:
					strncat(sibStr, " ESI * 2]", 15);
					return bpstrndup(sibStr, 100);
				case 0x38:
					strncat(sibStr, "EDI * 2]", 15);
					return bpstrndup(sibStr, 100);
			}
			break;
		 Scale row 0x2
		case 0x80:
			switch(index){
				case 0x00:
					strncat(sibStr, "EAX * 4]", 15);
					return bpstrndup(sibStr, 100);
				case 0x08:
					strncat(sibStr, "ECX * 4]", 15);
					return bpstrndup(sibStr, 100);
				case 0x10:
					strncat(sibStr, "EDX * 4]", 15);
					return bpstrndup(sibStr, 100);
				case 0x18:
					strncat(sibStr, "EBX * 4]", 15);
					return bpstrndup(sibStr, 100);
				 Empty Set
				case 0x20:
					memset(&sibStr[strlen(sibStr)-3], 0x00, 3);
					strncat(sibStr, "]", 7);
					return bpstrndup(sibStr, 100);
				case 0x28:
					strncat(sibStr, "EBP * 4]", 15);
					return bpstrndup(sibStr, 100);
				case 0x30:
					strncat(sibStr, "ESI * 4]", 15);
					return bpstrndup(sibStr, 100);
				case 0x38:
					strncat(sibStr, "EDI * 4]", 15);
					return bpstrndup(sibStr, 100);
			}
			break;
		case 0xc0:
			switch(index){
				case 0x00:
					strncat(sibStr, "EAX * 8]", 15);
					return bpstrndup(sibStr, 100);
				case 0x08:
					strncat(sibStr, "ECX * 8]", 15);
					return bpstrndup(sibStr, 100);
				case 0x10:
					strncat(sibStr, "EDX * 8]", 15);
					return bpstrndup(sibStr, 100);
				case 0x18:
					strncat(sibStr, "EBX * 8]", 15);
					return bpstrndup(sibStr, 100);
				 Empty Set
				case 0x20:
					memset(&sibStr[strlen(sibStr)-3], 0x00, 3);
					strncat(sibStr, "]", 1);
					return bpstrndup(sibStr, 100);
				case 0x28:
					strncat(sibStr, "EBP * 8]", 15);
					return bpstrndup(sibStr, 100);
				case 0x30:
					strncat(sibStr, "ESI * 8]", 15);
					return bpstrndup(sibStr, 100);
				case 0x38:
					strncat(sibStr, "EDI * 8]", 15);
					return bpstrndup(sibStr, 100);
			}
			break;
		default:
			break;
	}
	 add displacement here (sigh)
	return NULL;
}
char * X86_32_GetRmSibString ( P_X86_32_DECODED_INSTRUCTION_LIST partialDecode ) { size_t scale = IA32_SIB_GET_SCALE ( partialDecode -> sib ) ; size_t index = IA32_SIB_GET_INDEX ( partialDecode -> sib ) ; size_t base = IA32_SIB_GET_BASE ( partialDecode -> sib ) ; char sibStr [ 200 ] ; memset ( sibStr , 0x00 , 200 ) ; switch ( base ) { case 0x00 : strncat ( sibStr , " " , 5 ) ; break ; case 0x01 : strncat ( sibStr , " " , 5 ) ; break ; case 0x02 : strncat ( sibStr , " " , 5 ) ; break ; case 0x03 : strncat ( sibStr , " " , 5 ) ; break ; case 0x04 : strncat ( sibStr , " " , 5 ) ; break ; case 0x05 : break ; case 0x06 : strncat ( sibStr , " " , 5 ) ; break ; case 0x07 : strncat ( sibStr , " " , 5 ) ; break ; default : break ; } if ( strlen ( sibStr ) != 1 ) { strncat ( sibStr , " " , 3 ) ; } switch ( scale ) { case 0x00 : switch ( index ) { case 0x00 : strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x08 : strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x10 : strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x18 : strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x20 : memset ( & sibStr [ strlen ( sibStr ) - 3 ] , 0x00 , 3 ) ; strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x28 : strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x30 : strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x38 : strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; } break ; case 0x40 : switch ( index ) { case 0x00 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x08 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x10 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x18 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x20 : memset ( & sibStr [ strlen ( sibStr ) - 3 ] , 0x00 , 3 ) ; strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x28 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x30 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x38 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; } break ; case 0x80 : switch ( index ) { case 0x00 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x08 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x10 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x18 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x20 : memset ( & sibStr [ strlen ( sibStr ) - 3 ] , 0x00 , 3 ) ; strncat ( sibStr , " " , 7 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x28 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x30 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x38 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; } break ; case 0xc0 : switch ( index ) { case 0x00 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x08 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x10 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x18 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x20 : memset ( & sibStr [ strlen ( sibStr ) - 3 ] , 0x00 , 3 ) ; strncat ( sibStr , " " , 1 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x28 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x30 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; case 0x38 : strncat ( sibStr , " " , 15 ) ; return bpstrndup ( sibStr , 100 ) ; } break ; default : break ; } return NULL ; }
Retreives a SIB encoded string reflecting an encoded rm value.
Retreives a SIB encoded string reflecting an encoded rm value .
// Retrieve Scale Index And Base // Could Probably Be A Smaller Value // Contains none // strncat(sibStr, "[", 1); // displacement is always 32bits, must be // set before function entrancy though. // sprintf(&sibStr, "[%.08x", ) // Add the obligitary + symbol if the sib // base is not empty.  If it is omit the "+" // // Empty Set // Scale Row 1 // Empty Set // Scale row 0x2 // Empty Set // Empty Set // add displacement here (sigh)