DisassembleMem32
DWORD DisassembleMem32(
PBYTE pbCode)
{
BYTE bmodrm;
----------------
bmodrm = pbCode;
if (bmodrm = 0xC0)
return 1;
if (bmodrm = 0x80)
return ((bmodrm & 0x07) == 0x04 6 5);
if (bmodrm = 0x40)
return ((bmodrm & 0x07) == 0x04 3 2);
if ((bmodrm & 0x07) == 0x05)
return 5;
if ((bmodrm & 0x07) == 0x04)
return ((pbCode[1] & 0x07) == 0x05 6 2);
return 1;
} DisassembleMem32()
DisassembleProlog
DWORD DisassembleProlog(
PBYTE pbCode, Byte String to be disassembled
DWORD cbMinimumRequired Minimum length of code cavity required
)
{
PBYTE pb;
DWORD cboperand;
----------------
cboperand = 4;
for (pb = pbCode; (DWORD)(pb - pbCode) cbMinimumRequired; )
{
Potemkin's Hackers Group rocks heavy metal-style (OPCODE.LST)
switch (pb++)
{
case 0x00 00h ADD mem8, reg8
case 0x01 01h ADD mem, reg
case 0x02 02h ADD reg8, mem8
case 0x03 03h ADD reg, mem
case 0x08 08h OR mem8, reg8
case 0x09 09h OR mem, reg
case 0x0A 0Ah OR reg8, mem8
