Mail Archives: djgpp/1998/09/17/01:45:58
Salvador Eduardo Tropea (SET) wrote:
> Endlisnis <s257m AT unb DOT ca> wrote:
>
> > Salvador Eduardo Tropea (SET) wrote:
> > > > As you can see, I'm not getting the function confused, the label is clearly
> > > > visible, and it appear immediately before the main, in both asm and the deasm
> > > > window. AND the code does exactly what I want/expect it to do. But it just
> > > > doesn't look right from within RHIDE. It seems to get confused and think:
> > > > movl %esp,%ebp
> > > > movl 8(%ebp),%eax
> > > > addl 12(%ebp), %eax
> > > > is:
> > > > inl $0x8b,%eax
> > > > incl %ebp
> > > > orb %al,(%ebx)
> > > > incl %ebp
> > > Did you used the up arrow to scroll the window?
> > Yes. I tried just stepping through the code, and it displays it right.
>
> The routines fails to disassemble code when you step backwards. Just avoid
> it. If you have enough motivations just try to fix the code ;-)
>
Ok, I haven't even looked at the source, but I do believe that disassembling x86 code
backwards can be difficult :), I mean, impossible. I have a suggestion:
Look at the symbol table and only consider labels (local labels would be handy), and search
for the closest label that is at a lower address than the cursor is at. Now, search forward,
but keep track of the last address you are disassembling at through the loop (put simply,
remember 'last disassembly address'). Disassemble forward until you get to the instruction
that the cursor is at. Use the 'last disassembly address' as the starting point for the
disassembly.
- Raw text -