Skip to content

Instantly share code, notes, and snippets.

@winapiadmin
Created August 17, 2024 15:27
Show Gist options
  • Save winapiadmin/208ad3c9acd68bf843f2725767b7a9c7 to your computer and use it in GitHub Desktop.
Save winapiadmin/208ad3c9acd68bf843f2725767b7a9c7 to your computer and use it in GitHub Desktop.
print
for (size_t i = 0; i < count; ++i)
{
if (insn[i].bytes[0] == 0x90) {
continue;
}
if (addresses.find(insn[i].address) != addresses.end()) {
printf("%s:\n", addresses[insn[i].address]);
}
printf("0x%08llx: ", insn[i].address);
for (size_t j = 0; j < insn[i].size; ++j) {
printf("%02x ", insn[i].bytes[j]);
}
for (size_t j = 0; j < 15 - insn[i].size; ++j) {
printf(" ");
}
printf("%s ", insn[i].mnemonic);
char* endptr;
uint64_t addr;
switch (insn[i].bytes[0]) {
case 0x70 ... 0x7f:
if (has_rip_relative_addressing(&insn[i], handle)) {
addr = parse_rip_relative_addressing(&insn[i], handle);
} else {
addr = strtoull(insn[i].op_str, &endptr, 16);
if (*endptr != '\0') {
char* start_bracket = strchr(insn[i].op_str, '[');
if (start_bracket) {
char* end_bracket = strchr(start_bracket, ']');
if (end_bracket) {
*end_bracket = '\0';
addr = strtoull(start_bracket + 1, NULL, 16);
}
}
}
}
printf("%s\n", addresses[addr]);
case 0xe0 ... 0xeb:
case 0x9A:
// Handle far calls if needed
break;
case 0xff:
switch (insn[i].bytes[1]) {
case 0x02 ... 0x05:
if (has_rip_relative_addressing(&insn[i], handle)) {
addr = parse_rip_relative_addressing(&insn[i], handle);
} else {
addr = strtoull(insn[i].op_str, &endptr, 16);
if (*endptr != '\0') {
char* start_bracket = strchr(insn[i].op_str, '[');
if (start_bracket) {
char* end_bracket = strchr(start_bracket, ']');
if (end_bracket) {
*end_bracket = '\0';
addr = strtoull(start_bracket + 1, NULL, 16);
}
}
}
}
printf("%s\n", addresses[addr]);
break;
default:
printf("%s\n", insn[i].op_str);
break;
}
break;
case 0x0f:
switch (insn[i].bytes[1]) {
case 0x80 ... 0x8f:
if (has_rip_relative_addressing(&insn[i], handle)) {
addr = parse_rip_relative_addressing(&insn[i], handle);
} else {
addr = strtoull(insn[i].op_str, &endptr, 16);
if (*endptr != '\0') {
char* start_bracket = strchr(insn[i].op_str, '[');
if (start_bracket) {
char* end_bracket = strchr(start_bracket, ']');
if (end_bracket) {
*end_bracket = '\0';
addr = strtoull(start_bracket + 1, NULL, 16);
}
}
}
}
printf("%s\n", addresses[addr]);
break;
}
default:
printf("%s\n", insn[i].op_str);
break;
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment