Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- //Created by Riremito
- char Register[8][4] = {"eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi"};
- int ModRM(unsigned char *b){
- unsigned char Mod = (b[1] >> 6) & 3;
- unsigned char RO = (b[1] >> 3) & 7;
- unsigned char RM = b[1] & 7;
- unsigned long int disp32;
- unsigned char disp8;
- unsigned char SS = (b[2] >> 6) & 3;
- unsigned char Index = (b[2] >> 3) & 7;
- unsigned char Base = b[2] & 7;
- switch(Mod){
- case 0:
- switch(RM){
- case 4:
- disp32 = *(unsigned long int *)&b[3];
- switch(SS){
- case 0:
- printf("%s,[%08X+%s]", Register[RO], disp32, Register[Index]);
- break;
- case 1:
- printf("%s,[%08X+%s*2]", Register[RO], disp32, Register[Index]);
- break;
- case 2:
- printf("%s,[%08X+%s*4]", Register[RO], disp32, Register[Index]);
- break;
- case 3:
- printf("%s,[%08X+%s*8]", Register[RO], disp32, Register[Index]);
- break;
- }
- return 6;
- case 5:
- disp32 = *(unsigned long int *)&b[2];
- printf("%s,[%08X]", Register[RO], disp32);
- return 5;
- default:
- printf("%s,[%s]", Register[RO], Register[RM]);
- return 1;
- }
- printf("case 0");
- break;
- case 1:
- switch(RM){
- case 4:
- disp8 = b[3];
- switch(SS){
- case 0:
- printf("%s,[ebp+%02X+%s]", Register[RO], disp8, Register[Index]);
- break;
- case 1:
- printf("%s,[ebp+%02X+%s*2]", Register[RO], disp8, Register[Index]);
- break;
- case 2:
- printf("%s,[ebp+%02X+%s*4]", Register[RO], disp8, Register[Index]);
- break;
- case 3:
- printf("%s,[ebp+%02X+%s*8]", Register[RO], disp8, Register[Index]);
- break;
- }
- return 3;
- default:
- disp8 = b[2];
- printf("%s,[%s+%02X]", Register[RO], Register[RM], disp8);
- return 2;
- }
- printf("case 1");
- break;
- case 2:
- switch(RM){
- case 4:
- disp32 = *(unsigned long int *)&b[3];
- switch(SS){
- case 0:
- printf("%s,[ebp+%08X+%s]", Register[RO], disp32, Register[Index]);
- break;
- case 1:
- printf("%s,[ebp+%08X+%s*2]", Register[RO], disp32, Register[Index]);
- break;
- case 2:
- printf("%s,[ebp+%08X+%s*4]", Register[RO], disp32, Register[Index]);
- break;
- case 3:
- printf("%s,[ebp+%08X+%s*8]", Register[RO], disp32, Register[Index]);
- break;
- }
- return 6;
- default:
- disp32 = *(unsigned long int *)&b[2];
- printf("%s,[%s+%08X]", Register[RO], Register[RM], disp32);
- return 5;
- }
- printf("case 2");
- break;
- case 3:
- printf("%s,%s", Register[RO], Register[RM]);
- return 1;
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment