Beispiel #1
0
        public _mainForm()
        {
            InitializeComponent();

            _aobGen    = new AOBGenerator();
            this.Text += string.Format(" v{0}", this.GetType().Assembly.GetName().Version.ToString(3));
        }
Beispiel #2
0
        private void HandleByteFragments(StringBuilder sb, string secondFragment, string thirdFragment, bool alsoWildcardOffsets)
        {
            var byteFragments = secondFragment.Split(' ');

            bool offsetWildcarded = false;
            bool avxOpcode        = false;

            for (var i = 0; i < byteFragments.Length; i++)
            {
                var byteFragment = byteFragments[i];
                switch (byteFragment.Length)
                {
                case 2:
                    if ((alsoWildcardOffsets && i == byteFragments.Length - 1 && thirdFragment.Contains("+" + byteFragment) && !offsetWildcarded) || (avxOpcode && i > 0 && i != byteFragments.Length - 1))
                    {
                        sb.Append("?? ");
                    }
                    else
                    {
                        AOBGenerator.AppendByteFragment(sb, byteFragment);
                    }
                    break;

                case 6:
                    if (avxOpcode)
                    {
                        // assume part of RIP
                        sb.Append("?? ?? ?? ");
                    }
                    else
                    {
                        AOBGenerator.AppendByteFragment(sb, byteFragment);
                    }
                    break;

                case 8:
                    // offset or RIP relative block
                    // We convert the byteFragment to a hexadecimal number. If that number is present in third fragment, it's not a RIP relative address but an offset.
                    if (i > 0 && CheckIfShouldBeWildcarded(byteFragment.ToLowerInvariant(), thirdFragment, alsoWildcardOffsets, out bool performedOffsetWildcard))
                    {
                        offsetWildcarded |= performedOffsetWildcard;
                        sb.Append("?? ?? ?? ?? ");
                    }
                    else
                    {
                        if (i == 0)
                        {
                            avxOpcode = true;
                        }
                        AOBGenerator.AppendByteFragment(sb, byteFragment);
                    }
                    break;

                default:
                    AOBGenerator.AppendByteFragment(sb, byteFragment);
                    continue;
                }
            }
        }