pcode 0.1.3

Pure Rust implementation of a p-code disassembler and lifter.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

<?xml version="1.0" encoding="UTF-8"?>

<compiler_spec>
  <global>
    <range space="ram"/>
  </global>
  <stackpointer register="ESP" space="ram"/>
  <default_proto>
    <prototype name="__register" extrapop="unknown" stackshift="4">
      <input>
        <pentry minsize="1" maxsize="4">
          <register name="EAX"/>
        </pentry>
        <pentry minsize="1" maxsize="4">
          <register name="EDX"/>
        </pentry>
        <pentry minsize="1" maxsize="4">
          <register name="ECX"/>
        </pentry>
        <pentry minsize="1" maxsize="500" align="4">
          <addr offset="4" space="stack"/>
        </pentry>
      </input>
      <output>
        <pentry minsize="1" maxsize="4">
          <register name="EAX"/>
        </pentry>
      </output>
      <unaffected>
        <register name="ESP"/>
        <register name="EBP"/>
        <register name="ESI"/>
        <register name="EDI"/>
        <register name="EBX"/>
      </unaffected>
      <killedbycall>
        <register name="ECX"/>
        <register name="EDX"/>
      </killedbycall>
    </prototype>
  </default_proto>
  <!--there is also a "pascal" calling convention, which is the same as stdcall except that arguments are pushed left-to-right-->
  <prototype name="__stdcall" extrapop="unknown" stackshift="4">
    <input>
      <pentry minsize="1" maxsize="500" align="4">
        <addr offset="4" space="stack"/>
      </pentry>
    </input>
    <output>
      <pentry minsize="1" maxsize="4">
        <register name="EAX"/>
      </pentry>
    </output>
    <unaffected>
      <varnode space="ram" offset="0" size="4"/>
      <register name="ESP"/>
      <register name="EBP"/>
      <register name="ESI"/>
      <register name="EDI"/>
      <register name="EBX"/>
      <register name="DF"/>
    </unaffected>
    <killedbycall>
      <register name="ECX"/>
  	<register name="EDX"/>
    </killedbycall>
    <likelytrash>
      <register name="ECX"/>
    </likelytrash>
  </prototype>
  <prototype name="__cdecl" extrapop="4" stackshift="4">
    <input>
      <pentry minsize="1" maxsize="500" align="4">
        <addr offset="4" space="stack"/>
      </pentry>
    </input>
    <output>
      <pentry minsize="1" maxsize="4">
        <register name="EAX"/>
      </pentry>
    </output>
    <unaffected>
      <varnode space="ram" offset="0" size="4"/>
      <register name="ESP"/>
      <register name="EBP"/>
      <register name="ESI"/>
      <register name="EDI"/>
      <register name="EBX"/>
      <register name="DF"/>
    </unaffected>
    <killedbycall>
      <register name="ECX"/>
      <register name="EDX"/>
    </killedbycall>
    <likelytrash>
      <register name="ECX"/>
    </likelytrash>
  </prototype>
</compiler_spec>