Hi,

I'm interrested by disassembling x86 code in order to get their reladed instructions size. So i started some read work, asked a friend some explanations, but there is something I still dont get.

How do we know where the optional fields (modr/m, SIB etc etc) start, or even are present ?, how does it work ?

if I have to make a table, what should it has in ?

I already took a look at reverend LDE but tbh, the hash table ... lol, I did not even understood the meaning, by the way, i want to do it by myself and not using code I'm not good enough to understand.

thanks,

Intel IA-32 Manual Volume 2b has a table listing all instructions and their operand types. You need to construct a light version of such table in your disassembler: an opcode and flags for its type(start of the 2-byte opcode, prefix, invalid) and its operands (modrm, displacement, immediate) etc. As for SIB you just need to examine modrm byte to check if SIB is present.

I suggest you to read and download the beaengine.lib!

http://beatrix2004.free.fr/

If i remeber right, there're 2 pdf documents that explain very well how decode instructions!

Good lectures!

Hi,

Thanks for answering.

SFeLi, thanks for the advice, that's also what I found out, by reading some stuff.

I thought there would be a way to determine which field are used by which instruction with a byte mask in the opcode, or a logical operation to determine if ... or something like that.

Gyver thanks, (are you french?)
I already read the pdf, It was not explaining how to determine if field are used, I did not check the source code that Beatrix gives with, maybe I should !

hi,

Just for confirming, there is no possibility for an instruction to have a SIB without modR/M right ?

all things lead me to this conclusion, but it would be better for me to get a confirmation

thanks

SIB can be referred only through R/M field of ModR/M byte.

Thanks, I did not noticed that the disp was in fact included in the SIB like this one :

MOV DL,BYTE[DS:SI+0xFF]

I was counting a SIB + a 1 byte disp which was wrong.

btw, does any one know how I can test a length disassembler against all possible instructions ? is there any tool ? any file that contains all inst etc ?

Thanks