Pcode Opcode Meanings——VB__軟體分析

Pcode Opcode Meanings

==============================================================================

Prefixes:

------------------------------------------------------------------------------

Ad       Address

Imp      Import

Ld       Load

Lit      Literal(ie "Hi",2,8 )

Rf       Refrence

St       Store

V        Virtual

DOC      Duplicate/Redundante Opcode(in the table it will redirect you to another opcode)

------------------------------------------------------------------------------

Variable types:

------------------------------------------------------------------------------

I#      Integer (# - size: 2,4)

Cy      Currency

R#      Real (# - size: 4,8 - single)

Str     String

------------------------------------------------------------------------------

Informative (Takes no bytes tells how to process data):  

------------------------------------------------------------------------------

'>'      put the following hex in subsegments up to next offset following ArgStr

         char should be "p" for procedure address

'h'      return hex output of following typechars. possible(?%,&);

'}'      End Procedure

'<'      to stack

'|'      ignore

------------------------------------------------------------------------------   

Arguments (Will usually take bytes from the datastream):  

------------------------------------------------------------------------------

'.'      name Of Object at the Address specified by a Long off the datastream

'b'      a byte off the datastream - formerly '?

'%'      an integer off the datastream

'&'      a long off the datastream

'!'      a single off the datastream

'a'      an argument reference. Followed by an Int and a type char.

         Takes variable out of the ConstantPool

'c'      return the control index,uses one int from the datastream

'l'      return Local variable reference(uses int off datastream)

'L'      take (Value of Int off DataStream) local variable references

'm'      return Local Variable reference followed by typechar

'n'      return hex Integer

'o'      return item off the stack(Pop)

'p'      return (value of Integer  off datastream) + Procedure Base Address

't'      followed by typechar('o' return ObjectName;'c' return control name)

'u'      push...not used anymore

'v'      vTable this is slightly complicated ;)

'z'      return Null-Termed Unicode String From File(not used?)

------------------------------------------------------------------------------   

Type Characters

------------------------------------------------------------------------------

"b"     Byte

"?"     Boolean

"%"     Integer

"!"     Single

"&"     Long

"~"     Variant

"z"     String

------------------------------------------------------------------------------

00  2   LargeBos   

01  5   InvalidExcode   

02  2   SelectCaseByte  

03  1   DOC

04  3   FLdRfVar    ul  |                   'ignore used to load a copied var

05  3   ImpAdLdRf   a2  

06  3   MemLdRfVar  

07  5   FMemLdRf   

08  3   FLdPr   l   |                       ignore this loads a memory pointer for previous item? stores memory items address in variable next function uses address in variable

09  5   ImpAdCallHresult   

0A  5   ImpAdCallFPR4   h%h%   

0B  5   ImpAdCallI2

0C  5   ImpAdCallCy

0D  5   VCallHresult    vw  %p1

0E  3   VCallFPR8   

0F  3   VCallAd uc  |                       controlindex= (arg-760)/4

10  5   ThisVCallHresult   

11  3   ThisVCall   

12  3   ThisVCallAd

13  1   ExitProcHresult }   }   

14  1   ExitProc    }      

15  1   ExitProcI2         

16  1   ExitProcR4         

17  1   ExitProcR8         

18  1   ExitProcCy         

19  3   FStAdFunc   l   |                   ' always followed by FldPr ;i cant find a good not to ignore it

1A  3   FFree1Ad    l   |   

1B  3   LitStr  uaz |   

1C  3   BranchF >p  If (%p1) Then||End If   

1D  3   BranchT >p  

1E  3   Branch  >up Goto line%p1   

1F  3   CRec2Ansi   

20  3   CRec2Uni   

21  1   FLdPrThis   uto |   

22  3   ImpAdLdPr   

23  3   FStStrNoPop

24  3   NewIfNullPr h%  

25  1   PopAdLdVar      |                   'ignore comes after an optional param

26  3   AryDescTemp

27  3   LitVar_Missing  l   <   

28  5   LitVarI2    la2                     'have something on this  just confused

29  -1  FFreeAd L   |      

2A  1   ConcatStr       <%p2 & %p1  

2B  3   PopTmpLdAd2

2C  5   LateIdSt   

2D  3   AryUnlock   

2E  3   AryLock

2F  3   FFree1Str   l   |   

30  3   PopTmpLdAd8

31  3   FStStr  ums %p1 = %p2   

32  -1  FFreeStr    L   |   

33  3   LdFixedStr  

34  1   CStr2Ansi           

35  3   FFree1Var   l   |   

36  -1  FFreeVar    L   |   

37  1   PopFPR4         

38  3   CopyBytes   

39  1   PopFPR8         

3A  5   LitVarStr   luaz    |                   'have something on this  just confused

3B  1   Ary1StStrCopy           

3C  1   SetLastSystemError         

3D  3   CastAd  

3E  3   FLdZeroAd   l   |   

3F  3   CVarCy  

40  1   Ary1LdRf            

41  1   Ary1LdPr            

42  1   CR4Var         

43  3   FStStrCopy  ul  %p1=%p2

44  3   CVarI2  

45  1   Error           

46  3   CVarStr l      

47  3   StFixedStr  

48  3   ILdPr   

49  1   PopAdLd4            

4A  1   FnLenStr            

4B  3   OnErrorGoto                         'questions on this one too

4C  1   FnLBound            

4D  5   CVarRef

4E  3   FStVarCopyObj   ul  %p1 = %p2               ignore used to copy an object before passing

4F  3   MidStr  w   Mid(%p4,%p3,%p2) = %p1  

50  1   CI4Str         

51  3E  DOC

52  1   Ary1StVar           

53  1   CBoolCy