许久之前看到坛子里一位大牛搞了个虚拟机CM,小弟十分钦佩,就琢磨虚拟机到底是啥,后来想了想 以为虚拟机得用到反汇编引擎(现在觉得貌似不用),于是乎就想设计一套反汇编引擎,于是坛子里的egogg大牛的资料就被我找到了,于是我开发试着翻译《The Art Of Dissassembly》,只翻译了2章 太累,未果。看完那本书就开始构架,然后编码了。把那本书上介绍的mov指令都解析完了,猛然发现根本就不全面,然后找到一个全面的code table(egogg大牛提供)。然后继续编码,后来卡住了。。。继续参考egogg大牛代码,继续编码。 后来发现egogg大牛把指令给分解的非常完美了,继续参考。。完成。
I've been writing a disasm engine for x64 for a week.
The only documents I'm reading are:
1. Intel® 64 and IA-32 Architectures Software Developer's Manual 2A Instruction Set Reference A-M.pdf
2. Intel® 64 and IA-32 Architectures Software Developer's Manual 2B Instruction Set Reference N-Z.pdf
These are official documents and very straightforward. Note that in 1st doc, there are tables for ModRM and SIB decoding, and in 2nd one, there are detailed opcode maps in appendix.