Closed Symbai closed 6 years ago
This is impossible to implement. You can only decode in a forward manner because that's how CPU works. The first byte determine what the instruction is and the following bytes are operands.
You should at least specify the start address of the last instruction.
for example {0x3C, 0x03, 0xC8}
The 0x3C prefix means cmp with al
0x3C 0x03 = cmp al, 03
It happened to be meaningful. How can I know the exact execution instruction start at index 1?
But other disassembler supports this:
https://wiki.cheatengine.org/index.php?title=Lua:getPreviousOpcode https://stormsecurity.wordpress.com/2010/09/17/backward-disassembler-for-rop-exploitation/
@symbai you could do this by working backwards from the memory address 1-byte at a time until you get a valid instruction, however as Fonger said, it will not always be correct, ie there will be multiple possibilities as instruction lengths differ.
Even what you linked says the same thing.
Would be useful to retreive the previous instruction by a given byte array. Example:
Forward disassemble will always start with first byte in array but on backward disassemble the instruction lengths are unknown so a forward disassemble with shifted bytes lead to wrong results. That means with shifted bytes the last instruction can be different. This is why backward disassemble is required.