yegord / snowman

Snowman decompiler

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Support for `rol` and `ror`

carlreinke opened this issue · comments

Snowman outputs something like asm("rol ecx, 1"); and doesn't do proper data flow through the instruction.

Haven't done the flags yet, but this is a start.

            case UD_Iror: {
                auto size = operand(0).size();
                if (hasOperand(1)) {
                    _[operand(0) ^= (unsigned_(operand(0)) >> operand(1)) | (unsigned_(operand(0)) << (constant(size) - operand(1))) ];
                } else {
                    _[operand(0) ^= (unsigned_(operand(0)) >> constant(1)) | (unsigned_(operand(0)) << constant(size - 1)) ];
                }

                _[
                    cf ^= intrinsic(),
                    sf ^= undefined(),
                    zf ^= operand(0) == constant(0),
                    pf ^= intrinsic(),
                    less ^= ~(sf == of),
                    less_or_equal ^= less | zf,
                    below_or_equal ^= cf | zf
                ];
                break;
            }
            case UD_Irol: {
                auto size = operand(0).size();
                if (hasOperand(1)) {
                    _[operand(0) ^= (unsigned_(operand(0)) << operand(1)) | (unsigned_(operand(0)) >> (constant(size) - operand(1))) ];
                } else {
                    _[operand(0) ^= (unsigned_(operand(0)) << constant(1)) | (unsigned_(operand(0)) >> constant(size - 1)) ];
                }

                _[
                    cf ^= intrinsic(),
                    sf ^= undefined(),
                    zf ^= operand(0) == constant(0),
                    pf ^= intrinsic(),
                    less ^= ~(sf == of),
                    less_or_equal ^= less | zf,
                    below_or_equal ^= cf | zf
                ];
                break;
            }