Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include<stdio.h>
- #include<stdlib.h>
- char Register[8][4] = {"eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi"};
- int ModRM(unsigned char *b){
- unsigned char Mod = (b[1] >> 6) & 3;
- unsigned char RO = (b[1] >> 3) & 7;
- unsigned char RM = b[1] & 7;
- unsigned long int disp32;
- unsigned char disp8;
- unsigned char SS = (b[2] >> 6) & 3;
- unsigned char Index = (b[2] >> 3) & 7;
- unsigned char Base = b[2] & 7;
- switch(Mod){
- case 0:
- switch(RM){
- case 4:
- disp32 = *(unsigned long int *)&b[3];
- switch(SS){
- case 0:
- printf("%s,[%08X+%s]", Register[RO], disp32, Register[Index]);
- break;
- default:
- printf("%s,[%08X+%s*%02X]", Register[RO], disp32, Register[Index], (1 << SS));
- break;
- }
- return 6;
- case 5:
- disp32 = *(unsigned long int *)&b[2];
- printf("%s,[%08X]", Register[RO], disp32);
- return 5;
- default:
- printf("%s,[%s]", Register[RO], Register[RM]);
- return 1;
- }
- printf("case 0");
- break;
- case 1:
- switch(RM){
- case 4:
- disp8 = b[3];
- switch(SS){
- case 0:
- printf("%s,[ebp+%02X+%s]", Register[RO], disp8, Register[Index]);
- break;
- default:
- printf("%s,[ebp+%02X+%s*%02X]", Register[RO], disp8, Register[Index], (1 << SS));
- break;
- }
- return 3;
- default:
- disp8 = b[2];
- printf("%s,[%s+%02X]", Register[RO], Register[RM], disp8);
- return 2;
- }
- printf("case 1");
- break;
- case 2:
- switch(RM){
- case 4:
- disp32 = *(unsigned long int *)&b[3];
- switch(SS){
- case 0:
- printf("%s,[ebp+%08X+%s]", Register[RO], disp32, Register[Index]);
- break;
- default:
- printf("%s,[ebp+%08X+%s*%02X]", Register[RO], disp32, Register[Index], (1 << SS));
- break;
- }
- return 6;
- default:
- disp32 = *(unsigned long int *)&b[2];
- printf("%s,[%s+%08X]", Register[RO], Register[RM], disp32);
- return 5;
- }
- printf("case 2");
- break;
- case 3:
- printf("%s,%s", Register[RO], Register[RM]);
- return 1;
- }
- }
- unsigned char b[] = "\xEB\x48\x33\xC0\x03\xC2\x8B\x55\x18\x83\xE8\x08\x8B\x02\xC1\xE8\x08\x33\xC9\x8B\xC8\xC1\xE1\x08\x8B\x4D\x08\x03\x4D\xC8\x33\xD2\x8B\x5D\x08\x8A\x11\x80\xC2\x01\x8B\x4D\x18\x8B\x09\x80\xEA\x01\x33\xCA\x81\xE1\xFF\x00\x00\x00\x83\xF1\x16\x83\xF1\x16\x33\x04\x8D\xAC\xAD\xBC\x01\x8B\x55\x18\x89\x02\xE9\x9C\xFD\xFF\xFF";
- int main(){
- for(int i=0; i<70; i++){
- ModRM(&b[i]);
- printf("\n");
- }
- system("pause");
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement