Disassemble::X86::FormatText - Format machine instructions as text
use Disassemble::X86; $d = Disassemble::X86->new(format => "Text");
This module formats disassembled Intel x86 machine instructions as human-readable text. Output is in Intel assembler syntax, with a few minor exceptions, as described as below. Output is produced in lower case.
Certain conventions are used in order to make it easier for programs to process the output of the disassembler. This is useful when you don't want the complexity of working with the output of the FormatTree module. I find that these changes make the output more readable to humans as well.
Segment register override prefixes and address/operand size prefixes are incorporated into the argument list. In some cases, this is accomplished by using an "explicit operand" form of the instruction instead of the usual implicit form.
cs: xlatb becomes xlat byte[cs:ebx]
If other prefixes are present, they precede the opcode mnemonic
separated by single space characters. If the instruction has any
operands, they appear after another space, separated by commas. There
is no whitespace between or within operands, so you can separate the
parts of an instruction with split ' '. In order to make this
possible, the word "PTR" is omitted from memory operands.
mov 0x42, WORD PTR [edx] becomes mov 0x42,word[edx]
If one or more prefixes are present, but there are no operands, a single "." is added as an operand. This means you can always assume that the last component is an operand, if more than one component is present. The only case where this would normally occur is with string operations. However, this module always uses the explicit operand form for string ops.
rep movsb becomes rep movs byte[es:di],byte[si]
not rep movsb .
The memory operand size (byte, word, etc.) is usually included in the operand, even if it can be determined from context. That way, the size is not lost if later processing separates the operand from the rest of the instruction. (Some memory operands have no real size, though, while others have unusual sizes which are not shown.)
ADD eax,[0x1234] becomes add eax,dword[0x1234]
Unlike AT&T assembler syntax, individual operands never contain
embedded commas. This means that you can safely break up the operand
list with split/,/.
lea 0x0(,%ebx,4),%edi becomes lea edi,[ebx*4+0x0]
$text = Disassemble::X86::Text->format_instr($tree);
Accepts a machine instruction in tree format, and converts it to text.
Bob Mathews <bobmathews@alumni.calpoly.edu>
Copyright (c) 2002 Bob Mathews. All rights reserved.
This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.