disassembler

[minor28]

For those who want to test my disassembler.

I have tested on my own c++ and masm compiled programs and on others' programs, for example excel 2003. To disassemble excel took a while, about 3,000,000 lines.

I have as good as possible compared my decoded results with the results from dumpbin.exe. Some strange interpretations occur in both dumpbins and in my results. For example dumpbins "F2 B4 36 repne mov ah,36h" and my two lines "F2 repne" and "B4 36 mov ah,36h".

I have only tested on my Win10 OS.

[jj2007]

On Win7-64, I only get an invisible DialogApp window.

With some trickery, I can convince the window to maximise. Then, I see a menu. When opening a file, the app crashes, apparently in module ntdll. "Apparently" because Olly crashes, too, when trying to attach itself.

With this minor change:

Code Select Expand

if 0
invoke SetWindowPos,hWin,0,0,0,1000,1000,SWP_NOMOVE or SWP_NOZORDER
else
invoke SetWindowPos,hWin,0,0,0,500,500,SWP_NOMOVE or SWP_NOZORDER
endif
... I can at least see the app when launching it, but it still crashes when opening a file. RichMasm says you have heap corruption when trying to invoke GetOpenFileName :(

[TWell]

I can open it only with Shortcut with Maximized in Windows 8.1

[minor28]

Thank you.
I ran it on win7 32bit and it didn't show up

The window did not appear in the center of screen so I wrote

Code Select Expand


invoke SetWindowPos,hWin,0,0,0,1000,1000,SWP_NOMOVE or SWP_NOZORDER
invoke GetWindowRect,hWin,addr rect
invoke GetSystemMetrics,SM_CYSCREEN
add eax,rect.top
sub eax,rect.bottom
shr eax,1
push eax
invoke GetSystemMetrics,SM_CXSCREEN
add eax,rect.left
sub eax,rect.right
shr eax,1
pop edx
invoke SetWindowPos,hWin,0,eax,edx,0,0,SWP_NOSIZE or SWP_NOZORDER


Now I have changed it to

Code Select Expand


invoke SetWindowPos,hWin,0,0,0,1000,1000,SWP_NOMOVE or SWP_NOZORDER


Now it should show up. No crach for me on win7 32 bit.

[jj2007]

It doesn't crash for simple hello world proggies. But I tested it with the attached file, and that one crashes in the @opcode loop.

The attached exe expects a media file in the commandline. Btw using the commandline would make testing your code much easier, too. Using the open file dialog all the time is a PITA.

[minor28]

Sorry. I attached an exe where I try to write to the window during decoding to speed up large files. Here is the old one.

What is PlayVideosWithDShow.exe. Cannot open it.

[jj2007]

What is PlayVideosWithDShow.exe. Cannot open it.

Just a test; plays media files if you drag them over the exe (.avi, .wmv, .mpg, .wav, .mid, ...). For me, it works on XP, 7-64 and 10-64; but it crashes your disassembler (there is SSE2 code... ::)). What is your problem with the file?

Exe in Reply #5 has the same problems as before btw. Timestamp is today, 11:01:06

[minor28]

Thanks for the file. I had only tested a few SSE instructions. It was the fxsave instruction that caused the crash. There arae some direction errors also tho handle but they don't cause crasches.

The decoded file and updated files are attached.

[HSE]

Not good news:- Your site it's invisible

[jj2007]

The decoded file and updated files are attached.

The exe still doesn't show. My screen resolution is 1366x768.

You should check some instructions:

Code Select Expand

0040102E: AB stosw  ; should be stosd
00401052: 6A F1 push 0F1h  ; should be -0Fh
00401067: 6A F0 push 0F0h  ; should be -10h
004010F8: 6A FF push 0FFh  ; should be -1
0040110E: AD lodsw  ; should be lodsd

Works fine in general :t

[minor28]

AB and AD are both code for 16 and 32 bit but I forgot to take into account to the 16 bit prefix.

6A and 68 are codes for pushing 8 bit and 16/32bit immediate

Code Select Expand


6A ib - PUSH imm8 - I - Valid - Valid - Push imm8.
68 id - PUSH imm32 - I - Valid - Valid - Push imm32.


ml.exe interprets
"push -0Fh" as "6A F1 push 0FFFFFFF1h" and
"push -1" as "6A FF push 0FFFFFFFFh" and
"push 0F1h" as "68 F1 00 00 00 push 0F1h" and
"push -FFh" as "68 FF 00 00 00 push 0FFh"

Is this not confusing?

Edit:
Forgott to write to push an imm8 to the stack the imm8 is sign-extended.

[minor28]

My screen resolution is 3840x2160.

Thank HSE i will fix my site.

[jj2007]

My screen resolution is 3840x2160

Congrats, that is high end equipment :t

However, you should adjust your code accordingly, so that us poor mortals can see the dialog, too:

Code Select Expand

invoke GetWindowRect,hWin,addr rect
invoke GetSystemMetrics,SM_CYSCREEN
add eax,rect.top
sub eax,rect.bottom
shr eax,1
push eax
invoke GetSystemMetrics,SM_CXSCREEN
add eax,rect.left
sub eax,rect.right
shr eax,1
pop edx
invoke SetWindowPos,hWin,0,eax,edx,0,0,SWP_NOSIZE or SWP_NOZORDER

How exactly can you divide a 32-bit value by 2?

[minor28]

shift 1 bit right is not an exactly division by 2, at least not for odd numbers, but good enough for this operation.

[jj2007]

No, it's not. Division by 2 is done with SAR, not SHR, and when using SAR, your window becomes visible even on my tiny 1366px screen. The "A" stands for "arithmetic", and there is a good reason for that. If you want to test it, use 3000 instead of 1000 for invoke SetWindowPos,hWin,0,0,0,1000,1000,SWP_NOMOVE or SWP_NOZORDER, and put an int 3 in front. Then launch Olly, and you will understand why your window did not show on "normal" machines.