Exemple #1
0
        /// <summary>
        ///     Release Handle.
        /// </summary>
        /// <returns>
        ///     A boolean true if the handle was released. A boolean false otherwise.
        /// </returns>
        protected override bool ReleaseHandle()
        {
            var resultCode = CapstoneImport.Close(ref this.handle);
            var isReleased = resultCode == (int)DisassembleErrorCode.Ok;

            return(isReleased);
        }
            /// <summary>
            ///     Get Next Instruction.
            /// </summary>
            /// <returns>
            ///     A boolean true if an instruction is returned. A boolean false otherwise.
            /// </returns>
            /// <exception cref="System.ObjectDisposedException">
            ///     Thrown if the enumerator is disposed.
            /// </exception>
            public bool MoveNext()
            {
                this.CheckDisposed();

                var pCode         = this._pinnedCode.AddrOfPinnedObject() + this._currentOffset;
                var pCount        = (UIntPtr)1;
                var pInstructions = IntPtr.Zero;
                var pSize         = (UIntPtr)this._codeSize - this._currentOffset;

                // Disassemble Binary Code.
                //
                // ...
                var pResultCode = CapstoneImport.Disassemble((UIntPtr)(ulong)(long)_disassembler.Handle.DangerousGetHandle(),
                                                             pCode, pSize, this._currentAddress, pCount,
                                                             ref pInstructions);

                var iResultCode        = (int)pResultCode;
                var nativeInstructions = MarshalExtension.PtrToStructure <NativeInstruction>(pInstructions, iResultCode);

                if (nativeInstructions == null || nativeInstructions.Length == 0)
                {
                    return(false);
                }

                var instruction = nativeInstructions[0];

                this._currentInstruction = this._disassembler.CreateInstruction(instruction);
                this._currentAddress    += (ulong)this._currentInstruction.Bytes.Length;
                this._currentOffset     += this._currentInstruction.Bytes.Length;

                return(true);
            }
Exemple #3
0
        /// <summary>
        ///     Dispose Enumerator
        /// </summary>
        /// <param name="disposing">
        ///     A boolean true if the enumerator is being disposed from client code. A boolean false otherwise.
        /// </param>
        private void Dispose(bool disposing)
        {
            if (!this._disposed)
            {
                var pNativeInstructionCount = (UIntPtr)this._nativeInstructions.Length;
                CapstoneImport.Free(this._pNativeInstructions, pNativeInstructionCount);
            }

            this._disposed = true;
        }
        /// <summary>
        ///     Release Handle.
        /// </summary>
        /// <returns>
        ///     A boolean true if the handle was released. A boolean false otherwise.
        /// </returns>
        protected override bool ReleaseHandle()
        {
            CapstoneImport.Free(this.InstructionPointer, this._instructionCount);

            // Empty Instructions.
            //
            // ...
            this._instructions = Enumerable.Empty <NativeInstruction>();
            return(true);
        }
        /// <summary>
        ///     Set Disassemble Mode Option.
        /// </summary>
        /// <param name="handle">
        ///     A Capstone handle. Should not be a null reference.
        /// </param>
        /// <param name="mode">
        ///     A disassemble mode.
        /// </param>
        /// <exception cref="System.InvalidOperationException">
        ///     Thrown if the disassemble mode option could not be set.
        /// </exception>
        public static void SetDisassembleModeOption(SafeCapstoneHandle handle, DisassembleMode mode)
        {
            var       pHandle = handle.DangerousGetHandle();
            const int iOption = (int)DisassembleOptionType.Mode;

            // Set Disassemble Option.
            //
            // ...
            var resultCode = CapstoneImport.SetOption(pHandle, iOption, (IntPtr)mode);

            if (resultCode != (int)DisassembleErrorCode.Ok)
            {
                throw new InvalidOperationException("Unable to set disassemble mode option.");
            }
        }
        /// <summary>
        ///     Set Disassemble Syntax Option.
        /// </summary>
        /// <param name="handle">
        ///     A Capstone handle. Should not be a null reference.
        /// </param>
        /// <param name="value">
        ///     A syntax option value.
        /// </param>
        /// <exception cref="System.InvalidOperationException">
        ///     Thrown if the disassemble syntax option could not be set.
        /// </exception>
        public static void SetDisassembleSyntaxOption(SafeCapstoneHandle handle, DisassembleSyntaxOptionValue value)
        {
            // var pHandle = handle.DangerousGetHandle();
            const int iOption = (int)DisassembleOptionType.Syntax;

            // Set Disassemble Option.
            //
            // ...
            var resultCode = CapstoneImport.SetOption(unchecked ((UIntPtr)(ulong)(ulong)handle.DangerousGetHandle()),
                                                      iOption, (UIntPtr)value);

            if (resultCode != (int)DisassembleErrorCode.Ok)
            {
                throw new InvalidOperationException("Unable to set disassemble syntax option.");
            }
        }
        /// <summary>
        ///     Set Disassemble Details Option.
        /// </summary>
        /// <param name="handle">
        ///     A Capstone handle. Should not be a null reference.
        /// </param>
        /// <param name="flag">
        ///     A flag indicating whether to disable or enable the disassemble details option.
        /// </param>
        /// <exception cref="System.InvalidOperationException">
        ///     Thrown if the disassemble details option could not be set.
        /// </exception>
        public static void SetDisassembleDetails(SafeCapstoneHandle handle, bool flag)
        {
            var       pHandle = handle.DangerousGetHandle();
            const int iOption = (int)DisassembleOptionType.Detail;
            var       value   = flag ? (IntPtr)DisassembleOptionValue.On : (IntPtr)DisassembleOptionValue.Off;

            // Set Disassemble Option.
            //
            // ...
            var resultCode = CapstoneImport.SetOption(pHandle, iOption, value);

            if (resultCode != (int)DisassembleErrorCode.Ok)
            {
                throw new InvalidOperationException("Unable to set disassemble details option.");
            }
        }
        /// <summary>
        ///     Create a Capstone Disassembler.
        /// </summary>
        /// <param name="architecture">
        ///     The disassemble architecture.
        /// </param>
        /// <param name="mode">
        ///     The disassemble mode.
        /// </param>
        /// <returns>
        ///     A Capstone handle.
        /// </returns>
        /// <exception cref="System.InvalidOperationException">
        ///     Thrown if a Capstone disassembler could not be created.
        /// </exception>
        public static SafeCapstoneHandle Create(DisassembleArchitecture architecture, DisassembleMode mode)
        {
            var iArchitecture = (int)architecture;
            var iMode         = (int)mode;
            var pHandle       = IntPtr.Zero;

            // Open Capstone Handle.
            //
            // ...
            var resultCode = CapstoneImport.Open(iArchitecture, iMode, ref pHandle);

            if (resultCode != (int)DisassembleErrorCode.Ok)
            {
                throw new InvalidOperationException("Unable to create a Capstone disassembler.");
            }

            var handle = new SafeCapstoneHandle((UIntPtr)(ulong)(long)pHandle);

            return(handle);
        }
        /// <summary>
        ///     Disassemble Binary Code.
        /// </summary>
        /// <param name="handle">
        ///     A Capstone handle. Should not be a null reference.
        /// </param>
        /// <param name="code">
        ///     A collection of bytes representing the binary code to disassemble. Should not be a null reference.
        /// </param>
        /// <param name="count">
        ///     The number of instructions to disassemble. A 0 indicates all instructions should be disassembled.
        /// </param>
        /// <param name="startingAddress">
        ///     The address of the first instruction in the collection of bytes to disassemble.
        /// </param>
        /// <returns>
        ///     A native instruction handle.
        /// </returns>
        /// <exception cref="System.InvalidOperationException">
        ///     Thrown if the binary code could not be disassembled.
        /// </exception>
        public static SafeNativeInstructionHandle Disassemble(SafeCapstoneHandle handle, byte[] code, int count, ulong startingAddress)
        {
            // Copy Code to Unmanaged Memory.
            //
            // ...
            var pCode = MarshalExtension.AllocHGlobal <byte>(code.Length);

            Marshal.Copy(code, 0, pCode, code.Length);

            var pCount        = (UIntPtr)count;
            var pHandle       = handle.DangerousGetHandle();
            var pInstructions = IntPtr.Zero;
            var pSize         = (UIntPtr)code.Length;
            // var uStartingAddress = (ulong) startingAddress;

            // Disassemble Binary Code.
            //
            // ...
            var pResultCode = CapstoneImport.Disassemble(unchecked ((UIntPtr)(ulong)(ulong)handle.DangerousGetHandle()), pCode, pSize,
                                                         startingAddress, pCount, ref pInstructions);

            if (pResultCode == UIntPtr.Zero)
            {
                throw new InvalidOperationException("Unable to disassemble binary code.");
            }

            var iResultCode  = (int)pResultCode;
            var instructions = MarshalExtension.PtrToStructure <NativeInstruction>(pInstructions, iResultCode);

            // Free Unmanaged Memory.
            //
            // Avoid a memory leak.
            Marshal.FreeHGlobal(pCode);

            var instructionHandle = new SafeNativeInstructionHandle(instructions, pInstructions, pResultCode);

            return(instructionHandle);
        }