XDE反汇编引擎源码解读：1.02版优化与功能介绍

这是用c语言写的经典XDE反汇编引擎源代码


1.写在前面的话
                       eXtended (XDE) disassembler engine
                       ----------------------------------
                                 version 1.02

  History:

    1.01 - 1st release
    1.02 - lock prefix bug is fixed, thanx to www.core-dump.com.hr




  Note: its better to read "Permutation conditions" article before.

  XDE is based on the LDE/ADE engines. It allows you to find length of any x86
  instruction, source/destination register usage for most commonly
  used instructions, and to split/merge instruction to/from some binary
  structure.

  From program's viewpoint, CPU operates with: different types of registers,
  memory and io-devices.
  As such, there are introduced "object set" concept,
  which means bitset of registers/memory/etc. being read/written by
  each instruction.

  However, some of bits forming "object set" corresponds to

  multiple objects, for example we dont distinguish between segment/FPU/MMX/...
  registers, so we have XSET_OTHER bit flag, which, when used, means
  any set of them.

  Also, we dont distinguish between memory addresses.
  For example, XDE will return XSET_MEM bit flag for both "mov [eax], ebx"
  and "push ecx" instructions.
  This is because we're focused on the static file analysis, where register
  values are unknown in most cases.
  Also, like in the example shown, if eax points to the stack,
  two memory addresses could be equal (eax==esp),
  but we cant determine it without complex analysis
  which is not required for our purposes.

  I've rejected an idea from the "Permutation conditions" article,
  where "destination" object set overrides "source" object set;
  in the XDE engine there is no any relation between these sets.

  There are two subroutines:

int __cdecl xde_disasm(/* IN */ unsigned char *opcode,
                       /* OUT */ struct xde_instr *diza);

int __cdecl xde_asm(/* OUT */ unsigned char* opcode,
                    /* IN */ struct xde_instr* diza);

  xde_disasm() splits given instruction into the xde_instr structure.

  xde_asm() performs inverse operation: merges instruction from the
  given xde_instr structure.