-
Notifications
You must be signed in to change notification settings - Fork 7
/
Copy pathx86.rl
135 lines (132 loc) · 2.71 KB
/
x86.rl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
%%{
machine x86;
add_dx_i16 = 0x81.0xC2;
add_ebx_byte_i8 = 0x83.0xC3;
add_esp_byte_i8 = 0x83.0xC4;
and_al_i8 = 0x24;
and_ax_i16 = 0x25;
and_bh_i8 = 0x80.0xE7;
and_bl_i8 = 0x80.0xE3;
and_di_i16 = 0x81.0xE7;
and_dl_i8 = 0x80.0xE2;
and_edi_i32 = 0x81.0xE7;
and_esi_i32 = 0x81.0xE6;
and_si_i16 = 0x81.0xE6;
call_any16 = 0xE8.any.any;
call_any32 = 0xE8.any.any.any.any;
cli = 0xFA;
cmp_al_i8 = 0x3C;
cmp_ax_i16 = 0x3D;
cmp_bx_i16 = 0x81.0xFB;
cmp_di_byte_i8 = 0x83.0xFF;
cmp_ebx_any32 = 0x81.0xFB.any.any.any.any;
cmp_ebx_byte_i8 = 0x83.0xFB;
cmp_edi_byte_i8 = 0x83.0xFF;
cmp_esi_i32 = 0x81.0xFE;
cmp_si_i16 = 0x81.0xFE;
cs = 0x2E;
dec_ah = 0xFE.0xCC;
dec_cx = 0x49;
dec_dl = 0xFE.0xCA;
dec_dx = 0x4A;
dec_edx = 0x4A;
dec_esi = 0x4E;
in_al_dx = 0xEC;
inc_dl = 0xFE.0xC2;
inc_dx = 0x42;
inc_ebx = 0x43;
inc_edx = 0x42;
jg_i8 = 0x7F;
jl_i8 = 0x7C;
jmp_i8 = 0xEB;
jnl_i8 = 0x7D;
jnz_i8 = 0x75;
jz_i8 = 0x74;
leave = 0xC9;
loop_i8 = 0xE2;
mov_ah_i8 = 0xB4;
mov_al_ah = (0x8A.0xC4) | (0x88.0xE0);
mov_al_bl = 0x8A.0xC3;
mov_al_byte_bp_i8 = 0x8A.0x46;
mov_al_byte_ebp_i8 = 0x8A.0x45;
mov_al_cl = (0x8A.0xC1) | (0x88.0xC8);
mov_al_i8 = 0xB0;
mov_ax_bp_byte_i8 = 0x8B.0x46;
mov_ax_ebp_byte_i8 = 0x8B.0x45;
mov_ax_i16 = 0xB8;
mov_bh_al = 0x88.0xC7;
mov_bl_al = 0x88.0xC3;
mov_bp_sp = 0x8B.0xEC;
mov_bx_i16 = 0xBB;
mov_cl_al = 0x88.0xC1;
mov_cx_i16 = 0xB9;
mov_cx_word_any16 = 0x8B.0x0E.any.any;
mov_dx_dword_any32 = 0x66.0x8B.0x15.any.any.any.any;
mov_dx_i16 = 0xBA;
mov_dx_word_any16 = 0x8B.0x16.any.any;
mov_eax_i32 = 0xB8;
mov_ebp_esp = 0x8B.0xEC;
mov_ebx_i32 = 0xBB;
mov_ecx_i32 = 0xB9;
mov_edi_eax = 0x8B.0x8F;
mov_edx_dword_any32 = 0x8B.0x15.any.any.any.any;
mov_esi_i32 = 0xBE;
mov_word_bp_i8_i16 = 0xC7.0x46;
nop = 0x90;
o16 = 0x66;
or_ah_ah = 0x08.0xE4;
or_al_al = 0x08.0xC0;
or_bh_bl = 0x0A.0xFB;
or_cx_cx = 0x0B.0xC9;
out_dx_al = 0xEE;
pop_ax = 0x58;
pop_bp = 0x5D;
pop_bx = 0x5B;
pop_cx = 0x59;
pop_di = 0x5F;
pop_ds = 0x1F;
pop_dx = 0x5A;
pop_ebp = 0x5D;
pop_ebx = 0x5B;
pop_ecx = 0x59;
pop_edi = 0x5F;
pop_edx = 0x5A;
pop_esi = 0x5E;
pop_si = 0x5E;
popf = 0x9D;
push_ax = 0x50;
push_bp = 0x55;
push_bx = 0x53;
push_byte_i8 = 0x6A;
push_cs = 0x0E;
push_cx = 0x51;
push_di = 0x57;
push_ds = 0x1E;
push_dword_dword_any32 = 0xFF.0x35.any.any.any.any;
push_dword_ebp_i8 = 0xFF.0x75;
push_dx = 0x52;
push_ebp = 0x55;
push_ebx = 0x53;
push_ecx = 0x51;
push_edi = 0x57;
push_edx = 0x52;
push_esi = 0x56;
push_i32 = 0x68;
push_i8 = 0x6A;
push_si = 0x56;
pushf = 0x9C;
ret = 0xC3;
retf = 0xCB;
sti = 0xFB;
sub_eax_eax = 0x29.0xC0;
test_al_i8 = 0xA8;
test_byte_bp_i8_i8 = 0xF6.0x46;
test_byte_ebp_i8_i8 = 0xF6.0x45;
test_di_i16 = 0xF7.0xC7;
xchg_ah_al = 0x86.0xE0;
xor_ah_ah = 0x32.0xE4;
xor_al_al = 0x32.0xC0;
xor_bl_i8 = 0x80.0xF3;
xor_eax_eax = 0x31.0xC0;
xor_ebx_ebx = 0x31.0xDB;
}%%