1

I am apparently not very good with assembly as I am novice to somethings! Hence i wanted to make a question again. Now i got this from here to make something like a LDE (Length Disassembly Engine) Since I have knowledge of C/C++ and Object Pascal.

Now I see this

http://www.delphibasics.info/home/delphibasicssnippets/magicapihook

I understood everything only this getting the upcode part

Which is

function OpCodeLength(Address:DWORD):DWORD; cdecl; assembler;
const
  O_UNIQUE = 0;
  O_PREFIX = 1;
  O_IMM8 = 2;
  O_IMM16 = 3;
  O_IMM24 = 4;
  O_IMM32 = 5;
  O_IMM48 = 6;
  O_MODRM = 7;
  O_MODRM8 = 8;
  O_MODRM32 = 9;
  O_EXTENDED = 10;
  O_WEIRD = 11;
  O_ERROR = 12;
asm
 pushad
 cld
 xor edx, edx
 mov esi, Address
  mov ebp, esp
 push 1097F71Ch
 push 0F71C6780h
 push 17389718h
 push 101CB718h
 push 17302C17h
 push 18173017h
 push 0F715F547h
 push 4C103748h
 push 272CE7F7h
 push 0F7AC6087h
 push 1C121C52h
 push 7C10871Ch
 push 201C701Ch
 push 4767602Bh
 push 20211011h
 push 40121625h
 push 82872022h
 push 47201220h
 push 13101419h
 push 18271013h
 push 28858260h
 push 15124045h
 push 5016A0C7h
 push 28191812h
 push 0F2401812h
 push 19154127h
 push 50F0F011h
 mov ecx, 15124710h
 push ecx
 push 11151247h
 push 10111512h
 push 47101115h
 mov eax, 12472015h
 push eax
 push eax
 push 12471A10h
 add cl, 10h
 push ecx
 sub cl, 20h
 push ecx
 xor ecx, ecx
 dec ecx
@@ps:
 inc  ecx
 mov  edi, esp
@@go:
 lodsb
 mov  bh, al
@@ft:
 mov  ah, [edi]
 inc  edi
 shr  ah, 4
 sub  al, ah
 jnc  @@ft
 mov al, [edi-1]
 and al, 0Fh
 cmp  al, O_ERROR
 jnz  @@i7
 pop edx
 not edx
@@i7:
 inc edx
 cmp al, O_UNIQUE
 jz @@t_exit
 cmp al, O_PREFIX
 jz @@ps
 add  edi, 51h
 cmp  al, O_EXTENDED
 jz   @@go
 mov edi, [ebp+((1+8)*4)+4]
@@i6:
    inc  edx
    cmp  al, O_IMM8
    jz   @@t_exit
    cmp  al, O_MODRM
    jz   @@t_modrm
    cmp  al, O_WEIRD
    jz   @@t_weird
@@i5:
    inc  edx
    cmp  al, O_IMM16
    jz   @@t_exit
    cmp  al, O_MODRM8
    jz   @@t_modrm
@@i4:
    inc  edx
    cmp  al, O_IMM24
    jz   @@t_exit
@@i3:
    inc  edx
@@i2:
    inc  edx
    pushad
    mov  al, 66h
    repnz scasb
    popad
    jnz  @@c32
@@d2:
    dec  edx
    dec  edx
@@c32:
    cmp  al, O_MODRM32
    jz   @@t_modrm
    sub  al, O_IMM32
    jz   @@t_imm32
@@i1:
    inc  edx
@@t_exit:
    jmp @@ASMEnded
@@t_modrm:
       lodsb
       mov  ah, al
       shr  al, 7
       jb   @@prmk
       jz   @@prm
       add  dl, 4
       pushad
       mov  al, 67h
       repnz scasb
       popad
       jnz  @@prm
@@d3:  sub  dl, 3
       dec  al
@@prmk:jnz  @@t_exit
       inc  edx
       inc  eax
@@prm:
       and  ah, 00000111b
       pushad
       mov  al, 67h
       repnz scasb
       popad
       jz   @@prm67chk
       cmp  ah, 04h
       jz   @@prmsib
       cmp  ah, 05h
       jnz  @@t_exit
@@prm5chk:
       dec  al
       jz   @@t_exit
@@i42: add  dl, 4
       jmp  @@t_exit
@@prm67chk:
       cmp  ax, 0600h
       jnz  @@t_exit
       inc  edx
       jmp  @@i1
@@prmsib:
       cmp  al, 00h
       jnz  @@i1
       lodsb
       and  al, 00000111b
       sub  al, 05h
       jnz  @@i1
       inc  edx
       jmp  @@i42
@@t_weird:
       test byte ptr [esi], 00111000b
       jnz  @@t_modrm
       mov  al, O_MODRM8
       shr  bh, 1
       adc  al, 0
       jmp  @@i5
@@t_imm32:
       sub  bh, 0A0h
       cmp  bh, 04h
       jae  @@d2
       pushad
       mov  al, 67h
       repnz scasb
       popad
       jnz  @@chk66t
@@d4:  dec  edx
       dec  edx
@@chk66t:
       pushad
       mov  al, 66h
       repnz scasb
       popad
       jz   @@i1
       jnz  @@d2
@@ASMEnded:
    mov esp, ebp
    mov [result+(9*4)], edx
    popad
end;

Now here comes my Question, what exactly did the Author do at this point?

  O_UNIQUE = 0;
  O_PREFIX = 1;
  O_IMM8 = 2;
  O_IMM16 = 3;
  O_IMM24 = 4;
  O_IMM32 = 5;
  O_IMM48 = 6;
  O_MODRM = 7;
  O_MODRM8 = 8;
  O_MODRM32 = 9;
  O_EXTENDED = 10;
  O_WEIRD = 11;
  O_ERROR = 12;

And for the Assembly in brief detail, what did he do there. I am a Novice to Assembly.

1

An x86 instruction can be encoded in up to 15 bytes (AFAIK the CPU traps with Undefined opcode exception when exceeding the instruction length of 15 bytes).

O_PREFIX probably refers to an instruction prefix such as REP, or to instructions with implicit arguments. Encoded in 1 byte.

O_IMM8 is an instruction with one immediate argument, so it's encoded in 2 bytes (one for the instruction, one for the argument)

O_IMM16 takes an immediate argument of 2 bytes (16 bits), so it's encoded in 3 bytes.

And so on.

O_MODRM According to the Intel manual

Many instructions that refer to an operand in memory have an addressing-form specifier byte (called the ModR/M byte) following the primary opcode. Certain encodings of the ModR/M byte require a second addressing byte (the SIB byte)

Things get complicated here, and depending on the addressing mode you can have up to 9 bytes per instruction.

Don't know about O_EXTENDED (MMX? SSE? ...) or the other two.

Anyway, study the Intel manual, you should find everything in there: https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-2a-manual.pdf

1

If you're interested in learning (or using) length disassemblers for x86/x64, there are quite a few of them laying around, some with full documentation for your education:

  1. https://github.com/zyantific/zydis
  2. https://github.com/greenbender/lend
  3. https://github.com/CasualX/lde
  • +1 for Zydis, this is an amazing library! – mrexodia Sep 30 '18 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.