-
-
Save williballenthin/a94c4fcbd8a96d49db43d440e25aa0c6 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ''' | |
| display simple x86 instruction documentation as hints in ida pro. | |
| Author: Willi Ballenthin <william.ballenthin@fireeye.com> | |
| Licence: Apache 2.0 | |
| ''' | |
| import sys | |
| import json | |
| import datetime | |
| import idc | |
| import idaapi | |
| import idautils | |
| # inverse mapping of color value to name. | |
| # ref: https://www.hex-rays.com/products/ida/support/sdkdoc/group___s_c_o_l_o_r__.html#ga6052470f86411b8b5ffdf4af4bbee225 | |
| INV_COLORS = { | |
| 0x1: 'COLOR_DEFAULT', #= 0x01, // Default | |
| 0x2: 'COLOR_REGCMT', #= 0x02, // Regular comment | |
| 0x3: 'COLOR_RPTCMT', #= 0x03, // Repeatable comment (comment defined somewhere else) | |
| 0x4: 'COLOR_AUTOCMT', #= 0x04, // Automatic comment | |
| 0x5: 'COLOR_INSN', #= 0x05, // Instruction | |
| 0x6: 'COLOR_DATNAME', #= 0x06, // Dummy Data Name | |
| 0x7: 'COLOR_DNAME', #= 0x07, // Regular Data Name | |
| 0x8: 'COLOR_DEMNAME', #= 0x08, // Demangled Name | |
| 0x9: 'COLOR_SYMBOL', #= 0x09, // Punctuation | |
| 0xa: 'COLOR_CHAR', #= 0x0A, // Char constant in instruction | |
| 0xb: 'COLOR_STRING', #= 0x0B, // String constant in instruction | |
| 0xc: 'COLOR_NUMBER', #= 0x0C, // Numeric constant in instruction | |
| 0xd: 'COLOR_VOIDOP', #= 0x0D, // Void operand | |
| 0xe: 'COLOR_CREF', #= 0x0E, // Code reference | |
| 0xf: 'COLOR_DREF', #= 0x0F, // Data reference | |
| 0x10: 'COLOR_CREFTAIL', #= 0x10, // Code reference to tail byte | |
| 0x11: 'COLOR_DREFTAIL', #= 0x11, // Data reference to tail byte | |
| 0x12: 'COLOR_ERROR', #= 0x12, // Error or problem | |
| 0x13: 'COLOR_PREFIX', #= 0x13, // Line prefix | |
| 0x14: 'COLOR_BINPREF', #= 0x14, // Binary line prefix bytes | |
| 0x15: 'COLOR_EXTRA', #= 0x15, // Extra line | |
| 0x16: 'COLOR_ALTOP', #= 0x16, // Alternative operand | |
| 0x17: 'COLOR_HIDNAME', #= 0x17, // Hidden name | |
| 0x18: 'COLOR_LIBNAME', #= 0x18, // Library function name | |
| 0x19: 'COLOR_LOCNAME', #= 0x19, // Local variable name | |
| 0x1A: 'COLOR_CODNAME', #= 0x1A, // Dummy code name | |
| 0x1B: 'COLOR_ASMDIR', #= 0x1B, // Assembler directive | |
| 0x1C: 'COLOR_MACRO', #= 0x1C, // Macro | |
| 0x1D: 'COLOR_DSTR', #= 0x1D, // String constant in data directive | |
| 0x1E: 'COLOR_DCHAR', #= 0x1E, // Char constant in data directive | |
| 0x1F: 'COLOR_DNUM', #= 0x1F, // Numeric constant in data directive | |
| 0x20: 'COLOR_KEYWORD', #= 0x20, // Keywords | |
| 0x21: 'COLOR_REG', #= 0x21, // Register name | |
| 0x22: 'COLOR_IMPNAME', #= 0x22, // Imported name | |
| 0x23: 'COLOR_SEGNAME', #= 0x23, // Segment name | |
| 0x24: 'COLOR_UNKNAME', #= 0x24, // Dummy unknown name | |
| 0x25: 'COLOR_CNAME', #= 0x25, // Regular code name | |
| 0x26: 'COLOR_UNAME', #= 0x26, // Regular unknown name | |
| 0x27: 'COLOR_COLLAPSED',#= 0x27, // Collapsed line | |
| # // Fictive colors | |
| 0x28: 'COLOR_ADDR', #= 0x28, // hidden address marks | |
| # // The address is represented as 8digit | |
| # // hex number: 01234567 | |
| # // It doesn't have COLOR_OFF pair | |
| # // NB: for 64-bit IDA, the address is 16digit | |
| 0x29: 'COLOR_OPND1', #= COLOR_ADDR+1, // Instruction operand 1 | |
| 0x2A: 'COLOR_OPND2', #= COLOR_ADDR+2, // Instruction operand 2 | |
| 0x2B: 'COLOR_OPND3', #= COLOR_ADDR+3, // Instruction operand 3 | |
| 0x2C: 'COLOR_OPND4', #= COLOR_ADDR+4, // Instruction operand 4 | |
| 0x2D: 'COLOR_OPND5', #= COLOR_ADDR+5, // Instruction operand 5 | |
| 0x2E: 'COLOR_OPND6', #= COLOR_ADDR+6, // Instruction operand 6 | |
| 0x32: 'COLOR_UTF8', #= COLOR_ADDR+10;// Following text is UTF-8 encoded | |
| } | |
| class Symbol(object): | |
| def __init__(self, type): | |
| super(Symbol, self).__init__() | |
| self.type = type | |
| def __str__(self): | |
| raise NotImplementedError() | |
| class StringSymbol(Symbol): | |
| def __init__(self, string): | |
| super(StringSymbol, self).__init__('string') | |
| self.string = string | |
| def __str__(self): | |
| return 'STRING=' + self.string | |
| class ColorOnSymbol(Symbol): | |
| def __init__(self, color): | |
| super(ColorOnSymbol, self).__init__('coloron') | |
| self.color = ord(color) | |
| def __str__(self): | |
| return 'COLORON=' + INV_COLORS[self.color] | |
| class ColorOffSymbol(Symbol): | |
| def __init__(self, color): | |
| super(ColorOffSymbol, self).__init__('coloroff') | |
| self.color = ord(color) | |
| def __str__(self): | |
| return 'COLOROFF=' + INV_COLORS[self.color] | |
| class ColorInvSymbol(Symbol): | |
| def __init__(self): | |
| super(ColorInvSymbol, self).__init__('colorinv') | |
| def __str__(self): | |
| return 'COLORINV' | |
| def lex(curline): | |
| ''' | |
| split the line returned by `get_custom_viewer_curline` into symbols. | |
| it pulls out the strings, color directives, and escaped characters. | |
| Args: | |
| curline (str): a line returned by `idaapi.get_custom_viewer_curline` | |
| Returns: | |
| generator: generator of Symbol subclass instances | |
| ''' | |
| offset = 0 | |
| cur_word = [] | |
| while offset < len(curline): | |
| c = curline[offset] | |
| if c == idaapi.COLOR_ON: | |
| if cur_word: | |
| yield StringSymbol(''.join(cur_word)) | |
| cur_word = [] | |
| offset += 1 | |
| color = curline[offset] | |
| yield ColorOnSymbol(color) | |
| offset += 1 | |
| elif c == idaapi.COLOR_OFF: | |
| if cur_word: | |
| yield StringSymbol(''.join(cur_word)) | |
| cur_word = [] | |
| offset += 1 | |
| color = curline[offset] | |
| yield ColorOffSymbol(color) | |
| offset += 1 | |
| elif c == idaapi.COLOR_ESC: | |
| if cur_word: | |
| yield StringSymbol(''.join(cur_word)) | |
| cur_word = [] | |
| offset += 1 | |
| c = curline[offset] | |
| cur_word.append(c) | |
| offset += 1 | |
| elif c == idaapi.COLOR_INV: | |
| if cur_word: | |
| yield StringSymbol(''.join(cur_word)) | |
| cur_word = [] | |
| yield ColorInvSymbol() | |
| offset += 1 | |
| else: | |
| cur_word.append(c) | |
| offset += 1 | |
| def get_color_at_char(curline, index): | |
| curlen = 0 | |
| curcolor = 0 | |
| for sym in lex(curline): | |
| if sym.type == 'string': | |
| curlen += len(sym.string) | |
| if curlen >= index: | |
| return curcolor | |
| elif sym.type == 'coloron': | |
| curcolor = sym.color | |
| elif sym.type == 'coloroff': | |
| curcolor = 0 | |
| else: | |
| curcolor = 0 | |
| return curcolor | |
| class HintsHooks(idaapi.UI_Hooks): | |
| def get_custom_viewer_hint(self, view, place): | |
| tform = idaapi.get_current_tform() | |
| if idaapi.get_tform_type(tform) != idaapi.BWN_DISASM: | |
| return None | |
| curline = idaapi.get_custom_viewer_curline(view, True) | |
| _, x, y = idaapi.get_custom_viewer_place(view, True) | |
| ea = place.toea() | |
| color = get_color_at_char(curline, x) | |
| if color != idaapi.COLOR_INSN: | |
| return None | |
| mnem = idc.GetMnem(ea) | |
| try: | |
| return str(INSNS[mnem.upper()]), 1 | |
| except KeyError: | |
| return None | |
| class AsmDocHintsPlugin(idaapi.plugin_t): | |
| flags = idaapi.PLUGIN_KEEP | |
| comment = "Display simple x86 instruction documentation as hints." | |
| help = "Display simple x86 instruction documentation as hints." | |
| wanted_name = "AsmDocHints" | |
| wanted_hotkey = "Ctrl-[" | |
| def init(self): | |
| self.hooks = HintsHooks() | |
| return idaapi.PLUGIN_OK | |
| def run(self, arg): | |
| print('AsmDocHints: run') | |
| self.hooks.hook() | |
| def term(self): | |
| print('AsmDocHints: term') | |
| self.hooks.unhook() | |
| def PLUGIN_ENTRY(): | |
| return AsmDocHintsPlugin() | |
| INSNS = json.loads('''{"SLDT": "Store Local Descriptor Table Register", "POPA": "Pop All General-Purpose Registers", "UNPCKHPS": "Unpack and Interleave High Packed Single-FP Values", "POPF": "Pop Stack into rFLAGS Register", "FXTRACT": "Extract Exponent and Significand", "UNPCKHPD": "Unpack and Interleave High Packed Double-FP Values", "SYSEXIT": "Fast Return from Fast System Call", "ARPL": "Adjust RPL Field of Segment Selector", "FICOMP": "Compare Integer and Pop", "RETF": "Return from procedure", "FCHS": "Change Sign", "OUTSW": "Output String to Port", "PUNPCKHDQ": "Unpack High Data", "RETN": "Return from procedure", "FUCOM": "Unordered Compare Floating Point Values", "OUTSB": "Output String to Port", "OUTSD": "Output String to Port", "JNLE": "Jump short if not less nor equal/greater ((ZF=0) AND (SF=OF))", "WRMSR": "Write to Model Specific Register", "PMAXUB": "Maximum of Packed Unsigned Byte Integers", "GS": "GS segment override prefix", "ADDSD": "Add Scalar Double-FP Values", "CVTDQ2PD": "Convert Packed DW Integers to Double-FP Values", "POPCNT": "Bit Population Count", "MOVNTQ": "Store of Quadword Using Non-Temporal Hint", "JNS": "Jump short if not sign (SF=0)", "PMOVZXBW": "Packed Move with Zero Extend", "JNP": "Jump short if not parity/parity odd", "CMOVPE": "Conditional Move - parity/parity even (PF=1)", "PMOVZXBQ": "Packed Move with Zero Extend", "JNZ": "Jump short if not zero/not equal (ZF=1)", "FCOMI": "Compare Floating Point Values and Set EFLAGS", "CMOVPO": "Conditional Move - not parity/parity odd", "JNC": "Jump short if not below/above or equal/not carry (CF=0)", "JNB": "Jump short if not below/above or equal/not carry (CF=0)", "JNA": "Jump short if below or equal/not above (CF=1 AND ZF=1)", "JNG": "Jump short if less or equal/not greater ((ZF=1) OR (SF!=OF))", "JNE": "Jump short if not zero/not equal (ZF=1)", "JMPF": "Jump", "JMPE": "Jump to IA-64 Instruction Set", "JNO": "Jump short if not overflow (OF=0)", "FNSAVE": "Store x87 FPU State", "LAR": "Load Access Rights Byte", "JNL": "Jump short if not less/greater or equal (SF=OF)", "FLDL2T": "Load Constant log", "CMPS": "Compare String Operands", "FSUB": "Subtract", "MASKMOVDQU": "Store Selected Bytes of Double Quadword", "DIVPS": "Divide Packed Single-FP Values", "PHSUBD": "Packed Horizontal Subtract", "ROUNDPD": "Round Packed Double-FP Values", "CMC": "Complement Carry Flag", "CVTTPS2DQ": "Convert with Trunc. Packed Single-FP Values to DW Integers", "DIVPD": "Divide Packed Double-FP Values", "FLDL2E": "Load Constant log", "PMULHRSW": "Packed Multiply High with Round and Scale", "PHSUBW": "Packed Horizontal Subtract", "ROUNDPS": "Round Packed Single-FP Values", "XADD": "Exchange and Add", "XLATB": "Table Look-up Translation", "CMP": "Compare Two Operands", "CMOVLE": "Conditional Move - less or equal/not greater ((ZF=1) OR (SF!=OF))", "SCASD": "Scan String", "INVVPID": "Invalidate Translations Based on VPID", "LSL": "Load Segment Limit", "SCASB": "Scan String", "LSS": "Load Far Pointer", "LAHF": "Load Status Flags into AH Register", "PCMPGTQ": "Compare Packed Qword Data for Greater Than", "FYL2X": "Compute y \u00d7 log", "ADDSS": "Add Scalar Single-FP Values", "SFENCE": "Store Fence", "CVTPS2DQ": "Convert Packed Single-FP Values to DW Integers", "PBLENDW": "Blend Packed Words", "PCMPGTB": "Compare Packed Signed Integers for Greater Than", "PCMPGTD": "Compare Packed Signed Integers for Greater Than", "VMCLEAR": "Clear Virtual-Machine Control Structure", "MPSADBW": "Compute Multiple Packed Sums of Absolute Difference", "REX.RX": "REX.R and REX.X combination", "CVTPI2PD": "Convert Packed DW Integers to Double-FP Values", "INT": "Call to Interrupt Procedure", "HLT": "Halt", "PHMINPOSUW": "Packed Horizontal Word Minimum", "FINIT": "Initialize Floating-Point Unit", "INS": "Input from Port to String", "FCOMIP": "Compare Floating Point Values and Set EFLAGS and Pop", "CVTPI2PS": "Convert Packed DW Integers to Single-FP Values", "PACKUSWB": "Pack with Unsigned Saturation", "CBW": "Convert", "PUSHF": "Push rFLAGS Register onto the Stack", "NOT": "One's Complement Negation", "FCMOVNB": "FP Conditional Move - not below (CF=0)", "REX.RB": "REX.R and REX.B combination", "NOP": "No Operation", "FCMOVNE": "FP Conditional Move - not equal (ZF=0)", "INC": "Increment by 1", "CMPSQ": "Compare String Operands", "FSTP8": "Store Floating Point Value and Pop", "FS": "FS segment override prefix", "FCOMP3": "Compare Real and Pop", "CMPSW": "Compare String Operands", "REP": "Repeat String Operation Prefix", "FSTP1": "Store Floating Point Value and Pop", "FADDP": "Add and Pop", "ADDSUBPS": "Packed Single-FP Add/Subtract", "CMPSB": "Compare String Operands", "CMPSD": "Compare Scalar Double-FP Values", "ADDSUBPD": "Packed Double-FP Add/Subtract", "FCOM2": "Compare Real", "PSIGNW": "Packed SIGN", "SETE": "Set Byte on Condition - zero/equal (ZF=0)", "SETG": "Set Byte on Condition - not less nor equal/greater ((ZF=0) AND (SF=OF))", "SETA": "Set Byte on Condition - not below or equal/above (CF=0 AND ZF=0)", "SETB": "Set Byte on Condition - below/not above or equal/carry (CF=1)", "SETC": "Set Byte on Condition - below/not above or equal/carry (CF=1)", "SETL": "Set Byte on Condition - less/not greater (SF!=OF)", "SETO": "Set Byte on Condition - overflow (OF=1)", "ANDNPD": "Bitwise Logical AND NOT of Packed Double-FP Values", "BSR": "Bit Scan Reverse", "PSIGND": "Packed SIGN", "SETP": "Set Byte on Condition - parity/parity even (PF=1)", "PSIGNB": "Packed SIGN", "LFS": "Load Far Pointer", "SETS": "Set Byte on Condition - sign (SF=1)", "ANDNPS": "Bitwise Logical AND NOT of Packed Single-FP Values", "VMXON": "Enter VMX Operation", "REX.WXB": "REX.W, REX.X and REX.B combination", "XSETBV": "Set Extended Control Register", "OUT": "Output to Port", "LTR": "Load Task Register", "SETNP": "Set Byte on Condition - not parity/parity odd", "FDECSTP": "Decrement Stack-Top Pointer", "PSRLDQ": "Shift Double Quadword Right Logical", "PSLLDQ": "Shift Double Quadword Left Logical", "FCOS": "Cosine", "LGDT": "Load Global Descriptor Table Register", "CMOVNLE": "Conditional Move - not less nor equal/greater ((ZF=0) AND (SF=OF))", "FMUL": "Multiply", "FCOMPP": "Compare Real and Pop Twice", "SS": "SS segment override prefix", "SBB": "Integer Subtraction with Borrow", "CALLF": "Call Procedure", "PHADDSW": "Packed Horizontal Add and Saturate", "PUNPCKLDQ": "Unpack Low Data", "FCOMP": "Compare Real and Pop", "LODSQ": "Load String", "LODSW": "Load String", "FCMOVBE": "FP Conditional Move - below or equal (CF=1 or ZF=1)", "UNPCKLPD": "Unpack and Interleave Low Packed Double-FP Values", "PREFETCHT0": "Prefetch Data Into Caches", "PREFETCHT2": "Prefetch Data Into Caches", "PREFETCHT1": "Prefetch Data Into Caches", "LODSB": "Load String", "LODSD": "Load String", "JNBE": "Jump short if not below or equal/above (CF=0 AND ZF=0)", "CVTTSS2SI": "Convert with Trunc. Scalar Single-FP Value to DW Integer", "SCAS": "Scan String", "PMOVSXDQ": "Packed Move with Sign Extend", "PSHUFLW": "Shuffle Packed Low Words", "CDQE": "Convert", "FISUBR": "Reverse Subtract", "MOVNTI": "Store Doubleword Using Non-Temporal Hint", "FXCH4": "Exchange Register Contents", "FXCH7": "Exchange Register Contents", "PSADBW": "Compute Sum of Absolute Differences", "ICEBP": "Call to Interrupt Procedure", "FISUB": "Subtract", "STD": "Set Direction Flag", "FSUBRP": "Reverse Subtract and Pop", "XOR": "Logical Exclusive OR", "BTC": "Bit Test and Complement", "STC": "Set Carry Flag", "STI": "Set Interrupt Flag", "LDMXCSR": "Load MXCSR Register", "ORPS": "Bitwise Logical OR of Single-FP Values", "PMINSD": "Minimum of Packed Signed Dword Integers", "FSUBP": "Subtract and Pop", "STR": "Store Task Register", "FSUBR": "Reverse Subtract", "CVTPD2DQ": "Convert Packed Double-FP Values to DW Integers", "RSM": "Resume from System Management Mode", "PADDUSW": "Add Packed Unsigned Integers with Unsigned Saturation", "FABS": "Absolute Value", "PMADDUBSW": "Multiply and Add Packed Signed and Unsigned Bytes", "CALL": "Call Procedure", "FCLEX": "Clear Exceptions", "PADDUSB": "Add Packed Unsigned Integers with Unsigned Saturation", "VMREAD": "Read Field from Virtual-Machine Control Structure", "SETNG": "Set Byte on Condition - less or equal/not greater ((ZF=1) OR (SF!=OF))", "POPFD": "Pop Stack into eFLAGS Register", "PSRLD": "Shift Packed Data Right Logical", "HSUBPS": "Packed Single-FP Horizontal Subtract", "MOVNTDQA": "Load Double Quadword Non-Temporal Aligned Hint", "POPFQ": "Pop Stack into rFLAGS Register", "HSUBPD": "Packed Double-FP Horizontal Subtract", "REPZ": "Repeat String Operation Prefix", "SAL": "Shift", "SYSCALL": "Fast System Call", "REX.RXB": "REX.R, REX.X and REX.B combination", "FCMOVNBE": "FP Conditional Move - below or equal (CF=0 and ZF=0)", "FADD": "Add", "SAR": "Shift", "LOADALL": "Load All of the CPU Registers", "PACKSSDW": "Pack with Signed Saturation", "VMPTRST": "Store Pointer to Virtual-Machine Control Structure", "FRNDINT": "Round to Integer", "PMULLW": "Multiply Packed Signed Integers and Store Low Result", "DIVSD": "Divide Scalar Double-FP Values", "MOVMSKPS": "Extract Packed Single-FP Sign Mask", "PMOVSXWQ": "Packed Move with Sign Extend", "PMULLD": "Multiply Packed Signed Dword Integers and Store Low Result", "CMOVAE": "Conditional Move - not below/above or equal/not carry (CF=0)", "JAE": "Jump short if not below/above or equal/not carry (CF=0)", "PUSHAD": "Push All General-Purpose Registers", "DIVSS": "Divide Scalar Single-FP Values", "PCMPEQQ": "Compare Packed Qword Data for Equal", "PCMPEQW": "Compare Packed Data for Equal", "SHLD": "Double Precision Shift Left", "RCPSS": "Compute Reciprocal of Scalar Single-FP Values", "IDIV": "Signed Divide", "PCMPEQB": "Compare Packed Data for Equal", "PCMPEQD": "Compare Packed Data for Equal", "FXAM": "Examine", "PUNPCKLQDQ": "Unpack Low Data", "HADDPD": "Packed Double-FP Horizontal Add", "MOVSHDUP": "Move Packed Single-FP High and Duplicate", "VMLAUNCH": "Launch Virtual Machine", "HADDPS": "Packed Single-FP Horizontal Add", "PMINUD": "Minimum of Packed Unsigned Dword Integers", "LOOPNE": "Decrement count; Jump short if count!=0 and ZF=0", "PADDSW": "Add Packed Signed Integers with Signed Saturation", "ORPD": "Bitwise Logical OR of Double-FP Values", "PMOVZXBD": "Packed Move with Zero Extend", "FPTAN": "Partial Tangent", "FIDIV": "Divide", "PXOR": "Logical Exclusive OR", "VMPTRLD": "Load Pointer to Virtual-Machine Control Structure", "LOOPNZ": "Decrement count; Jump short if count!=0 and ZF=0", "SHR": "Shift", "SHRD": "Double Precision Shift Right", "MONITOR": "Set Up Monitor Address", "MOVSD": "Move Scalar Double-FP Value", "MOVSB": "Move Data from String to String", "CMPPD": "Compare Packed Double-FP Values", "MOVLHPS": "Move Packed Single-FP Values Low to High", "MOVQ2DQ": "Move Quadword from MMX Technology to XMM Register", "SQRTSS": "Compute Square Root of Scalar Single-FP Value", "SUBSS": "Subtract Scalar Single-FP Values", "MOVSX": "Move with Sign-Extension", "MOVSW": "Move Data from String to String", "CMPPS": "Compare Packed Single-FP Values", "SHL": "Shift", "MOVSS": "Move Scalar Single-FP Values", "ES": "ES segment override prefix", "MOVSQ": "Move Data from String to String", "MOVDQU": "Move Unaligned Double Quadword", "OUTS": "Output String to Port", "PSUBB": "Subtract Packed Integers", "BTS": "Bit Test and Set", "BTR": "Bit Test and Reset", "SGDT": "Store Global Descriptor Table Register", "PSUBUSW": "Subtract Packed Unsigned Integers with Unsigned Saturation", "FSCALE": "Scale", "PSUBW": "Subtract Packed Integers", "POPAD": "Pop All General-Purpose Registers", "PACKUSDW": "Pack with Unsigned Saturation", "LOOP": "Decrement count; Jump short if count!=0", "MOVDQA": "Move Aligned Double Quadword", "EXTRACTPS": "Extract Packed Single-FP Value", "FCOM": "Compare Real", "PUSHFQ": "Push rFLAGS Register onto the Stack", "IRETD": "Interrupt Return", "WBINVD": "Write Back and Invalidate Cache", "PAND": "Logical AND", "JBE": "Jump short if below or equal/not above (CF=1 AND ZF=1)", "PUSHFD": "Push eFLAGS Register onto the Stack", "MUL": "Unsigned Multiply", "PINSRD": "Insert Dword/Qword", "PMAXSW": "Maximum of Packed Signed Word Integers", "FFREE": "Free Floating-Point Register", "FFREEP": "Free Floating-Point Register and Pop", "PMAXSB": "Maximum of Packed Signed Byte Integers", "PMAXSD": "Maximum of Packed Signed Dword Integers", "PUSH": "Push Word, Doubleword or Quadword Onto the Stack", "SETNO": "Set Byte on Condition - not overflow (OF=0)", "XGETBV": "Get Value of Extended Control Register", "SETNL": "Set Byte on Condition - not less/greater or equal (SF=OF)", "PADDB": "Add Packed Integers", "FPREM1": "IEEE Partial Remainder", "CLD": "Clear Direction Flag", "FIMUL": "Multiply", "SETNC": "Set Byte on Condition - not below/above or equal/not carry (CF=0)", "SETNB": "Set Byte on Condition - not below/above or equal/not carry (CF=0)", "XORPD": "Bitwise Logical XOR for Double-FP Values", "CLC": "Clear Carry Flag", "FSTP": "Store Floating Point Value and Pop", "BLENDPD": "Blend Packed Double-FP Values", "FNINIT": "Initialize Floating-Point Unit", "SETNZ": "Set Byte on Condition - not zero/not equal (ZF=1)", "SETNAE": "Set Byte on Condition - below/not above or equal/carry (CF=1)", "PADDQ": "Add Packed Quadword Integers", "XORPS": "Bitwise Logical XOR for Single-FP Values", "FDISI": "Disable NPX Interrupt", "SETNS": "Set Byte on Condition - not sign (SF=0)", "FIADD": "Add", "WAIT": "Check pending unmasked floating-point exceptions", "SUBPS": "Subtract Packed Single-FP Values", "PUNPCKHBW": "Unpack High Data", "LLDT": "Load Local Descriptor Table Register", "CMPSS": "Compare Scalar Single-FP Values", "PTEST": "Logical Compare", "GETSEC": "GETSEC Leaf Functions", "JCXZ": "Jump short if eCX register is 0", "SETGE": "Set Byte on Condition - not less/greater or equal (SF=OF)", "MOVSXD": "Move with Sign-Extension", "AAD": "ASCII Adjust AX Before Division", "PUNPCKHQDQ": "Unpack High Data", "MOVLPD": "Move Low Packed Double-FP Value", "AAM": "ASCII Adjust AX After Multiply", "MINSS": "Return Minimum Scalar Single-FP Value", "PADDD": "Add Packed Integers", "MOVLPS": "Move Low Packed Single-FP Values", "AAS": "ASCII Adjust AL After Subtraction", "LODS": "Load String", "CMOVNP": "Conditional Move - not parity/parity odd", "MINSD": "Return Minimum Scalar Double-FP Value", "DS": "DS segment override prefix", "FNOP": "No Operation", "CVTTSD2SI": "Conv. with Trunc. Scalar Double-FP Value to Signed DW Int", "FICOM": "Compare Integer", "ADDPD": "Add Packed Double-FP Values", "PHADDD": "Packed Horizontal Add", "POR": "Bitwise Logical OR", "LOOPE": "Decrement count; Jump short if count!=0 and ZF=1", "LOOPZ": "Decrement count; Jump short if count!=0 and ZF=1", "MOVNTDQ": "Store Double Quadword Using Non-Temporal Hint", "INT1": "Call to Interrupt Procedure", "CMOVBE": "Conditional Move - below or equal/not above (CF=1 AND ZF=1)", "CMPXCHG": "Compare and Exchange", "REX.WRX": "REX.W, REX.R and REX.X combination", "PHADDW": "Packed Horizontal Add", "SETNE": "Set Byte on Condition - not zero/not equal (ZF=1)", "ADDPS": "Add Packed Single-FP Values", "VERR": "Verify a Segment for Reading", "VERW": "Verify a Segment for Writing", "SETALC": "Set AL If Carry", "INTO": "Call to Interrupt Procedure", "FSTSW": "Store x87 FPU Status Word", "CVTPS2PD": "Convert Packed Single-FP Values to Double-FP Values", "FLDPI": "Load Constant \u03c0", "BLENDVPS": "Variable Blend Packed Single-FP Values", "FUCOMPP": "Unordered Compare Floating Point Values and Pop Twice", "FNSTSW": "Store x87 FPU Status Word", "JPO": "Jump short if not parity/parity odd", "PADDW": "Add Packed Integers", "PSLLD": "Shift Packed Data Left Logical", "SWAPGS": "Swap GS Base Register", "MOVSLDUP": "Move Packed Single-FP Low and Duplicate", "CVTSI2SS": "Convert DW Integer to Scalar Single-FP Value", "JPE": "Jump short if parity/parity even (PF=1)", "SQRTSD": "Compute Square Root of Scalar Double-FP Value", "PSUBD": "Subtract Packed Integers", "TEST": "Logical Compare", "LGS": "Load Far Pointer", "SYSENTER": "Fast System Call", "CVTSI2SD": "Convert DW Integer to Scalar Double-FP Value", "PSLLQ": "Shift Packed Data Left Logical", "JZ": "Jump short if zero/equal (ZF=0)", "SCASW": "Scan String", "JP": "Jump short if parity/parity even (PF=1)", "SCASQ": "Scan String", "JS": "Jump short if sign (SF=1)", "JL": "Jump short if less/not greater (SF!=OF)", "RSQRTSS": "Compute Recipr. of Square Root of Scalar Single-FP Value", "JO": "Jump short if overflow (OF=1)", "JE": "Jump short if zero/equal (ZF=0)", "JG": "Jump short if not less nor equal/greater ((ZF=0) AND (SF=OF))", "JA": "Jump short if not below or equal/above (CF=0 AND ZF=0)", "JB": "Jump short if below/not above or equal/carry (CF=1)", "JC": "Jump short if below/not above or equal/carry (CF=1)", "REPNZ": "Repeat String Operation Prefix", "RDPMC": "Read Performance-Monitoring Counters", "VMWRITE": "Write Field to Virtual-Machine Control Structure", "PMOVMSKB": "Move Byte Mask", "FWAIT": "Check pending unmasked floating-point exceptions", "PCMPESTRI": "Packed Compare Explicit Length Strings, Return Index", "UNPCKLPS": "Unpack and Interleave Low Packed Single-FP Values", "PCMPESTRM": "Packed Compare Explicit Length Strings, Return Mask", "REPNE": "Repeat String Operation Prefix", "MULSS": "Multiply Scalar Single-FP Value", "RDMSR": "Read from Model Specific Register", "JECXZ": "Jump short if rCX register is 0", "MULSD": "Multiply Scalar Double-FP Values", "ENTER": "Make Stack Frame for Procedure Parameters", "MOVBE": "Move Data After Swapping Bytes", "FXSAVE": "Save x87 FPU, MMX, XMM, and MXCSR State", "FISTTP": "Store Integer with Truncation and Pop", "PANDN": "Logical AND NOT", "PMULDQ": "Multiply Packed Signed Dword Integers", "FSTENV": "Store x87 FPU Environment", "CVTSD2SS": "Convert Scalar Double-FP Value to Scalar Single-FP Value", "SHUFPD": "Shuffle Packed Double-FP Values", "SUBPD": "Subtract Packed Double-FP Values", "SQRTPD": "Compute Square Roots of Packed Double-FP Values", "NTAKEN": "Branch not taken prefix (only with Jcc instructions)", "FILD": "Load Integer", "VMCALL": "Call to VM Monitor", "LEAVE": "High Level Procedure Exit", "SHUFPS": "Shuffle Packed Single-FP Values", "LIDT": "Load Interrupt Descriptor Table Register", "F2XM1": "Compute 2", "PMOVZXDQ": "Packed Move with Zero Extend", "SQRTPS": "Compute Square Roots of Packed Single-FP Values", "PSUBUSB": "Subtract Packed Unsigned Integers with Unsigned Saturation", "FPREM": "Partial Remainder (for compatibility with i8087 and i287)", "PALIGNR": "Packed Align Right", "PMINSB": "Minimum of Packed Signed Byte Integers", "PCMPGTW": "Compare Packed Signed Integers for Greater Than", "MOVS": "Move Data from String to String", "LDS": "Load Far Pointer", "PMULHW": "Multiply Packed Signed Integers and Store High Result", "XLAT": "Table Look-up Translation", "XCHG": "Exchange Register/Memory with Register", "FINCSTP": "Increment Stack-Top Pointer", "MOVDQ2Q": "Move Quadword from XMM to MMX Technology Register", "PMINSW": "Minimum of Packed Signed Word Integers", "SMSW": "Store Machine Status Word", "XRSTOR": "Restore Processor Extended States", "JGE": "Jump short if not less/greater or equal (SF=OF)", "FTST": "Test", "CVTTPD2DQ": "Convert with Trunc. Packed Double-FP Values to DW Integers", "AND": "Logical AND", "PSHUFB": "Packed Shuffle Bytes", "FLDENV": "Load x87 FPU Environment", "PMINUW": "Minimum of Packed Unsigned Word Integers", "MOV": "Move to/from Test Registers", "PSHUFD": "Shuffle Packed Doublewords", "JLE": "Jump short if less or equal/not greater ((ZF=1) OR (SF!=OF))", "PSHUFW": "Shuffle Packed Words", "PMOVSXBD": "Packed Move with Sign Extend", "FPATAN": "Partial Arctangent and Pop", "FST": "Store Floating Point Value", "FIST": "Store Integer", "PMOVSXBQ": "Packed Move with Sign Extend", "AAA": "ASCII Adjust After Addition", "CVTTPS2PI": "Convert with Trunc. Packed Single-FP Values to DW Integers", "REX.WR": "REX.W and REX.R combination", "LDDQU": "Load Unaligned Integer 128 Bits", "RSQRTPS": "Compute Recipr. of Square Roots of Packed Single-FP Values", "PABSW": "Packed Absolute Value", "REX.WX": "REX.W and REX.X combination", "FDIVRP": "Reverse Divide and Pop", "REX.WB": "REX.W and REX.B combination", "CMOVNGE": "Conditional Move - less/not greater (SF!=OF)", "RDTSC": "Read Time-Stamp Counter", "MINPS": "Return Minimum Packed Single-FP Values", "MAXSD": "Return Maximum Scalar Double-FP Value", "FIDIVR": "Reverse Divide", "LOCK": "Assert LOCK# Signal Prefix", "IRET": "Interrupt Return", "MAXSS": "Return Maximum Scalar Single-FP Value", "MINPD": "Return Minimum Packed Double-FP Values", "FYL2XP1": "Compute y \u00d7 log", "CS": "CS segment override prefix", "ANDPD": "Bitwise Logical AND of Packed Double-FP Values", "VMXOFF": "Leave VMX Operation", "PSRLQ": "Shift Packed Data Right Logical", "JNGE": "Jump short if less/not greater (SF!=OF)", "PSRLW": "Shift Packed Data Right Logical", "SIDT": "Store Interrupt Descriptor Table Register", "XSAVE": "Save Processor Extended States", "CDQ": "Convert", "CLI": "Clear Interrupt Flag", "CRC32": "Accumulate CRC32 Value", "INSB": "Input from Port to String", "INSD": "Input from Port to String", "PADDSB": "Add Packed Signed Integers with Signed Saturation", "IMUL": "Signed Multiply", "RCR": "Rotate", "FCMOVNU": "FP Conditional Move - not unordered (PF=0)", "RCL": "Rotate", "INSW": "Input from Port to String", "SUBSD": "Subtract Scalar Double-FP Values", "DIV": "Unsigned Divide", "STOSD": "Store String", "PUSHA": "Push All General-Purpose Registers", "SETNBE": "Set Byte on Condition - not below or equal/above (CF=0 AND ZF=0)", "STOSB": "Store String", "FNDISI": "Treated as Integer NOP", "STOSW": "Store String", "INSERTPS": "Insert Packed Single-FP Value", "STOSQ": "Store String", "CMPXCHG16B": "Compare and Exchange Bytes", "FNENI": "Treated as Integer NOP", "REX.B": "Extension of r/m field, base field, or opcode reg field", "FNCLEX": "Clear Exceptions", "FCMOVU": "FP Conditional Move - unordered (PF=1)", "DPPD": "Dot Product of Packed Double-FP Values", "CMOVGE": "Conditional Move - not less/greater or equal (SF=OF)", "REX.R": "Extension of ModR/M reg field", "REX.WRB": "REX.W, REX.R and REX.B combination", "FSIN": "Sine", "REX.W": "64 Bit Operand Size", "IN": "Input from Port", "FCMOVE": "FP Conditional Move - equal (ZF=1)", "FLDCW": "Load x87 FPU Control Word", "REX.X": "Extension of SIB index field", "DPPS": "Dot Product of Packed Single-FP Values", "PMOVSXWD": "Packed Move with Sign Extend", "FCMOVB": "FP Conditional Move - below (CF=1)", "LFENCE": "Load Fence", "CVTSD2SI": "Convert Scalar Double-FP Value to DW Integer", "SETAE": "Set Byte on Condition - not below/above or equal/not carry (CF=0)", "CMOVNZ": "Conditional Move - not zero/not equal (ZF=1)", "FMULP": "Multiply and Pop", "CMOVNS": "Conditional Move - not sign (SF=0)", "FSQRT": "Square Root", "CMOVNO": "Conditional Move - not overflow (OF=0)", "CMOVNL": "Conditional Move - not less/greater or equal (SF=OF)", "CVTPS2PI": "Convert Packed Single-FP Values to DW Integers", "CMOVNG": "Conditional Move - less or equal/not greater ((ZF=1) OR (SF!=OF))", "HINT_NOP": "Hintable NOP", "CMOVNE": "Conditional Move - not zero/not equal (ZF=1)", "CMOVNC": "Conditional Move - not below/above or equal/not carry (CF=0)", "CMOVNB": "Conditional Move - not below/above or equal/not carry (CF=0)", "CMOVNA": "Conditional Move - below or equal/not above (CF=1 AND ZF=1)", "MOVAPS": "Move Aligned Packed Single-FP Values", "MOVD": "Move Doubleword/Quadword", "CMOVO": "Conditional Move - overflow (OF=1)", "MULPS": "Multiply Packed Single-FP Values", "REX": "Access to new 8-bit registers", "BT": "Bit Test", "MOVAPD": "Move Aligned Packed Double-FP Values", "FSTP9": "Store Floating Point Value and Pop", "POP": "Pop a Value from the Stack", "JRCXZ": "Jump short if rCX register is 0", "MULPD": "Multiply Packed Double-FP Values", "ALTER": "Alternating branch prefix (only with Jcc instructions)", "INVLPG": "Invalidate TLB Entry", "MOVQ": "Move Quadword", "PABSD": "Packed Absolute Value", "SAHF": "Store AH into Flags", "PHSUBSW": "Packed Horizontal Subtract and Saturate", "CLFLUSH": "Flush Cache Line", "PABSB": "Packed Absolute Value", "MOVMSKPD": "Extract Packed Double-FP Sign Mask", "FDIVP": "Divide and Pop", "PSUBQ": "Subtract Packed Quadword Integers", "FDIVR": "Reverse Divide", "FDIV": "Divide and Pop", "EMMS": "Empty MMX Technology State", "CVTSS2SI": "Convert Scalar Single-FP Value to DW Integer", "MOVHPD": "Move High Packed Double-FP Value", "CMOVZ": "Conditional Move - zero/equal (ZF=0)", "CQO": "Convert", "CMOVP": "Conditional Move - parity/parity even (PF=1)", "CMOVS": "Conditional Move - sign (SF=1)", "CMOVL": "Conditional Move - less/not greater (SF!=OF)", "MOVHPS": "Move High Packed Single-FP Values", "TAKEN": "Branch taken prefix (only with Jcc instructions)", "CMOVA": "Conditional Move - not below or equal/above (CF=0 AND ZF=0)", "PCMPISTRM": "Packed Compare Implicit Length Strings, Return Mask", "CMOVC": "Conditional Move - below/not above or equal/carry (CF=1)", "CMOVE": "Conditional Move - zero/equal (ZF=0)", "PCMPISTRI": "Packed Compare Implicit Length Strings, Return Index", "CMOVG": "Conditional Move - not less nor equal/greater ((ZF=0) AND (SF=OF))", "MOVUPD": "Move Unaligned Packed Double-FP Values", "LMSW": "Load Machine Status Word", "INVEPT": "Invalidate Translations Derived from EPT", "MOVZX": "Move with Zero-Extend", "ANDPS": "Bitwise Logical AND of Packed Single-FP Values", "MOVUPS": "Move Unaligned Packed Single-FP Values", "STMXCSR": "Store MXCSR Register State", "ROUNDSD": "Round Scalar Double-FP Values", "PEXTRD": "Extract Dword/Qword", "OR": "Logical Inclusive OR", "FXRSTOR": "Restore x87 FPU, MMX, XMM, and MXCSR State", "CLTS": "Clear Task-Switched Flag in CR0", "FRSTOR": "Restore x87 FPU State", "PSLLW": "Shift Packed Data Left Logical", "FLDLN2": "Load Constant log", "UD2": "Undefined Instruction", "PMULUDQ": "Multiply Packed Unsigned DW Integers", "DEC": "Decrement by 1", "PMADDWD": "Multiply and Add Packed Integers", "FLD": "Load Floating Point Value", "PMAXUW": "Maximum of Packed Unsigned Word Integers", "PEXTRW": "Extract Word", "ROL": "Rotate", "FUCOMP": "Unordered Compare Floating Point Values and Pop", "JMP": "Jump", "CVTDQ2PS": "Convert Packed DW Integers to Single-FP Values", "AMX": "Adjust AX After Multiply", "PMAXUD": "Maximum of Packed Unsigned Dword Integers", "PMOVSXBW": "Packed Move with Sign Extend", "BLENDPS": "Blend Packed Single-FP Values", "PEXTRB": "Extract Byte", "ROR": "Rotate", "INVD": "Invalidate Internal Caches", "FNSETPM": "Treated as Integer NOP", "PMULHUW": "Multiply Packed Unsigned Integers and Store High Result", "SETLE": "Set Byte on Condition - less or equal/not greater ((ZF=1) OR (SF!=OF))", "PUNPCKHWD": "Unpack High Data", "CVTPD2PS": "Convert Packed Double-FP Values to Single-FP Values", "CVTPD2PI": "Convert Packed Double-FP Values to DW Integers", "RDTSCP": "Read Time-Stamp Counter and Processor ID", "MFENCE": "Memory Fence", "FENI": "Enable NPX Interrupt", "BOUND": "Check Array Index Against Bounds", "REX.WRXB": "REX.W, REX.R, REX.X and REX.B combination", "CMOVNBE": "Conditional Move - not below or equal/above (CF=0 AND ZF=0)", "UD": "Undefined Instruction", "FLDLG2": "Load Constant log", "SYSRET": "Return From Fast System Call", "FSTCW": "Store x87 FPU Control Word", "FLDZ": "Load Constant +0.0", "SUB": "Subtract", "NEG": "Two's Complement Negation", "FCOMP5": "Compare Real and Pop", "MAXPD": "Return Maximum Packed Double-FP Values", "STOS": "Store String", "SETNLE": "Set Byte on Condition - not less nor equal/greater ((ZF=0) AND (SF=OF))", "CVTSS2SD": "Convert Scalar Single-FP Value to Scalar Double-FP Value ", "REX.XB": "REX.X and REX.B combination", "REPE": "Repeat String Operation Prefix", "MAXPS": "Return Maximum Packed Single-FP Values", "PMINUB": "Minimum of Packed Unsigned Byte Integers", "FBSTP": "Store BCD Integer and Pop", "PINSRW": "Insert Word", "PINSRQ": "Insert Dword/Qword", "SALC": "Set AL If Carry", "CWD": "Convert", "FSAVE": "Store x87 FPU State", "CMPXCHG8B": "Compare and Exchange Bytes", "PINSRB": "Insert Byte", "PREFETCHNTA": "Prefetch Data Into Caches", "FBLD": "Load Binary Coded Decimal", "IRETQ": "Interrupt Return", "PSUBSW": "Subtract Packed Signed Integers with Signed Saturation", "SETNA": "Set Byte on Condition - below or equal/not above (CF=1 AND ZF=1)", "FNSTENV": "Store x87 FPU Environment", "PAVGW": "Average Packed Integers", "MOVNTPD": "Store Packed Double-FP Values Using Non-Temporal Hint", "FSETPM": "Set Protected Mode", "ADX": "Adjust AX Before Division", "CPUID": "CPU Identification", "ADD": "Add", "ADC": "Add with Carry", "PSUBSB": "Subtract Packed Signed Integers with Signed Saturation", "BLENDVPD": "Variable Blend Packed Double-FP Values", "CWDE": "Convert", "MOVNTPS": "Store Packed Single-FP Values Using Non-Temporal Hint", "BSF": "Bit Scan Forward", "PAVGB": "Average Packed Integers", "LEA": "Load Effective Address", "SETNGE": "Set Byte on Condition - less/not greater (SF!=OF)", "MASKMOVQ": "Store Selected Bytes of Quadword", "FLD1": "Load Constant +1.0", "LES": "Load Far Pointer", "SETZ": "Set Byte on Condition - zero/equal (ZF=0)", "MOVHLPS": "Move Packed Single-FP Values High to Low", "PSRAW": "Shift Packed Data Right Arithmetic", "PUNPCKLWD": "Unpack Low Data", "COMISD": "Compare Scalar Ordered Double-FP Values and Set EFLAGS", "PSRAD": "Shift Packed Data Right Arithmetic", "PACKSSWB": "Pack with Signed Saturation", "FSINCOS": "Sine and Cosine", "COMISS": "Compare Scalar Ordered Single-FP Values and Set EFLAGS", "RCPPS": "Compute Reciprocals of Packed Single-FP Values", "FXCH": "Exchange Register Contents", "DAA": "Decimal Adjust AL after Addition", "SETBE": "Set Byte on Condition - below or equal/not above (CF=1 AND ZF=1)", "CMOVNAE": "Conditional Move - below/not above or equal/carry (CF=1)", "FUCOMIP": "Unordered Compare Floating Point Values and Set EFLAGS and Pop", "DAS": "Decimal Adjust AL after Subtraction", "FUCOMI": "Unordered Compare Floating Point Values and Set EFLAGS", "MOVDDUP": "Move One Double-FP and Duplicate", "BSWAP": "Byte Swap", "PUNPCKLBW": "Unpack Low Data", "PAUSE": "Spin Loop Hint", "CMOVB": "Conditional Move - below/not above or equal/carry (CF=1)", "ROUNDSS": "Round Scalar Single-FP Values", "SETPE": "Set Byte on Condition - parity/parity even (PF=1)", "FNSTCW": "Store x87 FPU Control Word", "JNAE": "Jump short if below/not above or equal/carry (CF=1)", "PEXTRQ": "Extract Dword/Qword", "SETPO": "Set Byte on Condition - not parity/parity odd", "FISTP": "Store Integer and Pop", "PMOVZXWQ": "Packed Move with Zero Extend", "PBLENDVB": "Variable Blend Packed Bytes", "VMRESUME": "Resume Virtual Machine", "UCOMISD": "Unordered Compare Scalar Double-FP Values and Set EFLAGS", "PMOVZXWD": "Packed Move with Zero Extend", "CVTTPD2PI": "Convert with Trunc. Packed Double-FP Values to DW Integers", "UCOMISS": "Unordered Compare Scalar Single-FP Values and Set EFLAGS", "PSHUFHW": "Shuffle Packed High Words", "MWAIT": "Monitor Wait"}''') |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
screenshot