Intel有一款名为XED的库,可以处理x86/x86_64指令:https://github.com/intelxed/xed,同时也是在x86和x86_64模式下处理英特尔机器码的唯一正确方式。Intel使用它(并且它曾是Pin的一部分):https://software.intel.com/en-us/articles/xed-x86-encoder-decoder-software-library
https://software.intel.com/sites/landingpage/pintool/docs/67254/Xed/html/main.html XED用户指南(2014年)
https://software.intel.com/sites/landingpage/pintool/docs/56759/Xed/html/main.html
XED2用户指南(2011年)
xed_decode
函数将为您提供有关指令的所有信息:https://intelxed.github.io/ref-manual/group__DEC.html
https://intelxed.github.io/ref-manual/group__DEC.html#ga9a27c2bb97caf98a6024567b261d0652
xed_ild_decode
只会解码其长度的指令:
https://intelxed.github.io/ref-manual/group__DEC.html#ga4bef6152f61997a47c4e0fe4327a3254
XED_DLL_EXPORT xed_error_enum_t xed_ild_decode ( xed_decoded_inst_t * xedd,
const xed_uint8_t * itext,
const unsigned int bytes
)
This function just does instruction length decoding.
It does not return a fully decoded instruction.
Parameters
- xedd the decoded instruction of type xed_decoded_inst_t . Mode/state sent in via xedd; See the xed_state_t .
- itext the pointer to the array of instruction text bytes
- bytes the length of the itext input array. 1 to 15 bytes, anything more is ignored.
Returns:
xed_error_enum_t indiciating success (XED_ERROR_NONE) or
failure. Only two failure codes are valid for this function:
XED_ERROR_BUFFER_TOO_SHORT and XED_ERROR_GENERAL_ERROR. In general
this function cannot tell if the instruction is valid or not. For
valid instructions, XED can figure out if enough bytes were provided
to decode the instruction. If not enough were provided, XED returns
XED_ERROR_BUFFER_TOO_SHORT. From this function, the
XED_ERROR_GENERAL_ERROR is an indication that XED could not decode the
instruction's length because the instruction was so invalid that even
its length may across implementations.
要从由
xed_ild_decode
填充的
xedd
结构中获取长度,请使用
xed_decoded_inst_get_length
:
https://intelxed.github.io/ref-manual/group__DEC.html#gad1051f7b86c94d5670f684a6ea79fcdf。
static XED_INLINE xed_uint_t xed_decoded_inst_get_length ( const xed_decoded_inst_t * p )
Return the length of the decoded instruction in bytes.
示例代码(由英特尔2016年发布的“Apache许可证,版本2.0”):https://github.com/intelxed/xed/blob/master/examples/xed-ex-ild.c
#include "xed/xed-interface.h"
#include <stdio.h>
int main()
{
xed_bool_t long_mode = 1;
xed_decoded_inst_t xedd;
xed_state_t dstate;
unsigned char itext[15] = { 0xf2, 0x2e, 0x4f, 0x0F, 0x85, 0x99,
0x00, 0x00, 0x00 };
xed_tables_init();
if (long_mode)
dstate.mmode=XED_MACHINE_MODE_LONG_64;
else
dstate.mmode=XED_MACHINE_MODE_LEGACY_32;
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
xed_ild_decode(&xedd, itext, XED_MAX_INSTRUCTION_BYTES);
printf("length = %u\n",xed_decoded_inst_get_length(&xedd));
return 0;
}
任何其他解决方案,例如手动前缀/操作码解析或使用第三方反汇编器,可能会在某些罕见情况下给您错误的结果。我们不知道英特尔内部使用哪个库来验证其硬件指令解码器,但 xed 是他们各种二进制工具中软件解码器使用的库。xed 的 ild 解码器有超过 1600 行代码:
https://github.com/intelxed/xed/blob/master/src/dec/xed-ild.c,应该比任何其他库更精确。