I'm trying to write my own disassembler for PE,PE+ and ELF executables but I'm stuck with a big problem on PE and PE+ executables.
I'm checking my work by comparing my output with objdump, and I found some (bad) opcodes appear in the disassembled program. I immediately checked the instruction manual to control these values; they are shown as invalid in instruction manual. Some examples:
Example from PE files:
40dad1: d6 (bad)
402f1c: ff (bad)
402f1d: ff (bad)
402f1e: ff (bad)
402f1f: ff 01 incl (%ecx) #at last a valid instruction
These are valid when I check the manual, but I cannot understand this (it's a PE+ file, architecture is AMD64):
f0 db a5 4e 9c 95 68 lock (bad) [rbp+0x68959c4e]
f0 is lock prefix
db means its a x87 instruction
a5 is ModRM byte(10 100 101) and by looking mod and reg fields we can say it's an invalid instruction
4e 9c 95 68 is used as 4byte disp but why ?
Do we assume that it's an invalid indirect x87 opcode and we continue to read as it's a valid opcode? I suppose objdump chooses this path.
And what are these (bad) instructions for? It's clear that they are not for aligning; or am I doing something wrong?
Btw, I'm trying to disassemble my old projects and FireFox to check if my program works. I'm using
objdump -z -d -M intel XXYYZZ.exe to disassemble.