// compare a chuck of the context record contained between the two offsets
private bool CheckContextChunk(X86Context a1, X86Context a2, int startOffset, int endOffset)
{
using (var c1 = a1.OpenForDirectAccess())
{
using (var c2 = a2.OpenForDirectAccess())
{
for (int i = startOffset; i < endOffset; i++)
{
if (Marshal.ReadByte(c1.RawBuffer, i) != Marshal.ReadByte(c2.RawBuffer, i))
{
return(false);
}
}
}
}
return(true);
}
private bool CheckX86Contexts(X86Context a1, X86Context a2)
{
bool retVal = false;
if ((a1.Flags & ContextFlags.X86ContextControl) == ContextFlags.X86ContextControl)
{
// Due to runtime limitations, we can't check EFLAGS and SegSs, see DevDiv 186645
retVal = CheckContextChunk(a1, a2, (int)X86Offsets.Ebp, (int)X86Offsets.EFlags);
if (!retVal)
{
return(retVal);
}
retVal = CheckContextChunk(a1, a2, (int)X86Offsets.Esp, (int)X86Offsets.SegSs);
if (!retVal)
{
return(retVal);
}
}
if ((a1.Flags & ContextFlags.X86ContextInteger) == ContextFlags.X86ContextInteger)
{
// check range Edi to Eax
retVal = CheckContextChunk(a1, a2, (int)X86Offsets.Edi, (int)X86Offsets.Ebp);
if (!retVal)
{
return(retVal);
}
}
if ((a1.Flags & ContextFlags.X86ContextFloatingPoint) == ContextFlags.X86ContextFloatingPoint)
{
// check range FLOAT_SAVE
retVal = CheckContextChunk(a1, a2, (int)X86Offsets.FloatSave, (int)X86Offsets.SegGs);
if (!retVal)
{
return(retVal);
}
}
return(true);
}