Stuff

from System.CodeDom import *from System.CodeDom.Compiler import CodeDomProvider, CodeGeneratorOptionsfrom System.IO import StringWriterimport System.String, System.Int16CS = 0x2EDS = 0x3EES = 0x26FS = 0x64GS = 0x65SS = 0x36OPSIZE = 0x66ADSIZE = 0x67LOCK = 0xF0REPNE = 0xF2REP = 0xF3class Decompiler(object):	ARITH_ADD = CodeBinaryOperatorType.Add	ARITH_SUB = CodeBinaryOperatorType.Subtract	ARITH_MUL = CodeBinaryOperatorType.Multiply	ARITH_DIV = CodeBinaryOperatorType.Divide	ARITH_XOR = '^'	ARITH_LSL = '<<'	ARITH_LSR = '>>'		def compileExpr(expr):		provider = CodeDomProvider.CreateProvider('CSharp')		options = CodeGeneratorOptions()		options.BracingStyle = 'Block'		writer = StringWriter()		provider.GenerateCodeFromExpression(expr, writer, options)		ret = writer.ToString()		writer.Close()		return ret		def arith(op, A, B):		if isinstance(op, CodeBinaryOperatorType):			return CodeBinaryOperatorExpression(				A,				op,				B			)		else:			return CodeSnippetExpression(					'%s %s %s' % (						compileExpr(A),						oper,						compileExpr(B)					)				)	add = lambda A, B: arith(ARITH_ADD, A, B)	sub = lambda A, B: arith(ARITH_SUB, A, B)	mul = lambda A, B: arith(ARITH_MUL, A, B)	div = lambda A, B: arith(ARITH_DIV, A, B)	xor = lambda A, B: arith(ARITH_XOR, A, B)	lsl = lambda A, B: arith(ARITH_LSL, A, B)	lsr = lambda A, B: arith(ARITH_LSR, A, B)		move = CodeAssignStatement		def branch(L, C=None, cond=None, hintTaken=False):		pass		def comp(op, A, B):		pass		V = 1		def formE(size, code, first, off, prefixes, (mod, reg, rm)):		print mod, reg, rm		forms = {		'E' : (True, formE),		'G' : (True, formG),	}	sizes = {		'v' : V,	}		def form(formstr):		outform = []		for opc in formstr.split(','):			outform.append((forms[opc[0]], sizes[opc[1]]))		return tuple(outform)		opcodes = {		0x33 : (form('Gv,Ev'), lambda D, S: move(D, xor(D, S)), False),	}		def decode(self, code, off):		prefixes = []		c = ord(code[off])		off += 1		while c in (CS, DS, ES, FS, GS, SS, OPSIZE, ADSIZE, LOCK, REPNE, REP):			prefixes.append(c)			c = ord(code[off])			off += 1				if c in self.opcodes:			opcd = self.opcodes[c]		else:			c = (c << 8) | ord(code[off])			off += 1						if c in self.opcodes:				opcd = self.opcodes[c]			else:				c = (c << 8) | ord(code[off])				off += 1								if c in self.opcodes:					opcd = self.opcodes[c]				else:					raise DecoderError('Unknown opcode: %06x (may not be three bytes)' % c)				first = off		modrm = None				ops = []		forms, func, branch = opcd		for form in forms:			(hasModrm, form), size = form			if hasModrm:				modrm = ord(code[first])				modrm = modrm >> 6, (modrm >> 3) & 7, modrm & 7				off += 1				break		for form in forms:			(hasModrm, form), size = form			if hasModrm:				off, stmt = form(size, code, first, off, prefixes, modrm)			else:				off, stmt = form(size, code, first, off, prefixes)			ops.append(stmt)				return func(*ops), off, branch		def decompile(self, code, off):		method = CodeMemberMethod()		method.Name = 'Decompiled'		method.ReturnType = CodeTypeReference(System.String)		method.Attributes = MemberAttributes.Public				branch = False		while not branch:			stmt, off, branch = self.decode(code, off)			method.Statements.Add(stmt)