Multi-mode specification-driven disassembler
View Patent ↗One embodiment of the present invention provides a system that facilitates implementing multi-mode specification-driven disassembler. During operation, the disassembler receives a machine-code version of a computer program. In order to disassemble a specific machine-code instruction from this machine-code version, the system compares the machine-code instruction against a set of instruction templates for assembly code instructions to identify a set of matching templates. Next, the system selects a matching template from the set of matching templates based on the state of a mode variable, which indicates a specificity mode for the disassembler. The system then disassembles the machine-code instruction using the operand fields defined by the matching template to produce a corresponding assembly code instruction.
1. A method for implementing a disassembler, wherein the disassembler is a mode-settable, specification-driven disassembler, comprising:
receiving a machine-code version of a computer program;
comparing a machine-code instruction from the machine-code version of the computer program against a set of templates for assembly code instructions to identify a set of matching templates;
selecting a matching template from the set matching templates based on the state of a mode variable indicating a specificity mode for the disassembler, wherein the specificity mode variable indicates whether a more-specific or a less-specific assembly code representation of the machine-code instruction is to be selected; and
disassembling the machine-code instruction using the operand fields defined by the matching template to produce a corresponding assembly code instruction.
2. The method of claim 1 , wherein a given template includes an opcode template, an opcode mask, and a specificity for the given template.
3. The method of claim 2 , wherein comparing the machine-code instruction against a specific instruction template involves:
performing a bitwise-AND operation between the machine-code instruction and the opcode mask;
comparing a result of the bitwise-AND operation with the opcode template; and
if the result matches the opcode template, identifying the specific instruction template as a matching template.
4. The method of claim 3 , further comprising:
reassembling the corresponding assembly code instruction into a machine-code instruction; and
if the resulting machine-code instruction is not a valid machine-code instruction, removing the corresponding instruction template from the set of matching instruction templates.
5. The method of claim 2 , wherein the specificity indicates a number of bits that are set to one within the opcode mask of the given template.
6. The method of claim 5 , wherein the specificity mode specifies using either a most specific template or a least specific template.
7. The method of claim 6 , further comprising allowing a user to set the specificity mode for the disassembler through a graphical user interface.
8. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for implementing a disassembler, wherein the disassembler is a mode-settable, specification-driven disassembler, the method comprising:
receiving a machine-code version of a computer program;
comparing a machine-code instruction from the machine-code version of the computer program against a set of templates for assembly code instructions to identify a set of matching templates;
selecting a matching template from the set matching templates based on the state of a mode variable indicating a specificity mode for the disassembler, wherein the specificity mode variable indicates whether a more-specific or a less-specific assembly code representation of the machine-code instruction is to be selected; and
disassembling the machine-code instruction using the operand fields defined by the matching template to produce a corresponding assembly code instruction.
9. The computer-readable storage medium of claim 8 , wherein a given template includes an opcode template, an opcode mask, and a specificity for the given template.
10. The computer-readable storage medium of claim 9 , wherein comparing the machine-code instruction against a specific instruction template involves:
performing a bitwise-AND operation between the machine-code instruction and the opcode mask;
comparing a result of the bitwise-AND operation with the opcode template; and
if the result matches the opcode template, identifying the specific instruction template as a matching template.
11. The computer-readable storage medium of claim 10 , the method further comprising:
reassembling the corresponding assembly code instruction into a machine-code instruction; and
if the resulting machine-code instruction is not a valid machine-code instruction, removing the corresponding instruction template from the set of matching instruction templates.
12. The computer-readable storage medium of claim 9 , wherein the specificity indicates a number of bits that are set to one within the opcode mask of the given template.
13. The computer-readable storage medium of claim 12 , wherein the specificity mode specifies using either a most specific template or a least specific template.
14. The computer-readable storage medium of claim 13 , the method further comprising allowing a user to set the specificity mode for the disassembler through a graphical user interface.
15. An apparatus for implementing a disassembler, wherein the disassembler is a mode-settable, specification-driven disassembler, comprising:
a receiving mechanism that is configured to receive a machine-code version of a computer program;
a comparing mechanism that is configured to compare a machine-code instruction from the machine-code version of the computer program against a set of templates for assembly code instructions to identify a set of matching templates;
a selecting mechanism that is configured to select a matching template from the set matching templates based on the state of a mode variable indicating a specificity mode for the disassembler, wherein the specificity mode variable indicates whether a more-specific or a less-specific assembly code representation of the machine-code instruction is to be selected; and
a disassembling mechanism that is configured to disassemble the machine-code instruction using the operand fields defined by the matching template to produce a corresponding assembly code instruction.
16. The apparatus of claim 15 , wherein a given template includes an opcode template, an opcode mask, and a specificity for the given template.
17. The apparatus of claim 16 , further comprising:
a logic mechanism that is configured to perform a bitwise-AND operation between the machine-code instruction and the opcode mask;
wherein the comparing mechanism is further configured to compare a result of the bitwise-AND operation with the opcode template; and
an identifying mechanism that is configured to identify the specific instruction template as a matching template if the result of the bitwise-AND matches the opcode template.
18. The apparatus of claim 17 , further comprising:
a reassembling mechanism that is configured to reassemble the corresponding assembly code instruction into a machine-code instruction; and
a removing mechanism that is configured to remove the corresponding instruction template from the set of matching instruction templates if the resulting machine-code instruction is not a valid machine-code instruction.
19. The apparatus of claim 16 , wherein the specificity indicates a number of bits that are set to one within the opcode mask of the given template.
20. The apparatus of claim 19 , wherein the specificity mode specifies using either a most specific template or a least specific template.
21. The apparatus of claim 20 , further comprising a mode selecting mechanism that is configured to allow a user to set the specificity mode for the disassembler through a graphical user interface.