Exemple #1
0
    private static unsafe void Main(string[] args)
    {
      var buf = new byte[4];
      buf[0] = (byte) 0xc3;
      buf[1] = (byte) 0x33;
      buf[2] = (byte) 0xc0;
      buf[3] = (byte) 0xc3;
      var ci = new CodeInfo((long) 0x1000, buf, DecodeType.Decode32Bits, 0);
      var dr = new DecodedResult(10);
      diStorm3.Decode(ci, dr);

      foreach (var x in dr.Instructions) {
        var s = String.Format("{0:X} {1} {2}", x.Offset, x.Mnemonic, x.Operands);
        Console.WriteLine(s);
      }

      var dr2 = new DecomposedResult(10);
      diStorm3.Decompose(ci, dr2);

      foreach (var y in dr2.Instructions) {
        if (y.Opcode != Opcode.RET)
        {
          var x = diStorm3.Format(ci, y);
          var s = String.Format("{0:X} {1} {2}", x.Offset, x.Mnemonic, x.Operands);
          Console.WriteLine(s);
        }
      }

    }
Exemple #2
0
        private static unsafe _CodeInfo *AcquireCodeInfoStruct(CodeInfo nci, out GCHandle gch)
        {
            var ci = (_CodeInfo *)Malloc(sizeof(_CodeInfo));

            if (ci == null)
            {
                throw new OutOfMemoryException();
            }

            Memset(ci, 0, sizeof(_CodeInfo));

            ci->codeOffset = new IntPtr(nci._codeOffset);
            gch            = GCHandle.Alloc(nci._code, GCHandleType.Pinned);

            ci->code     = (byte *)gch.AddrOfPinnedObject().ToPointer();
            ci->codeLen  = nci._code.Length;
            ci->dt       = nci._decodeType;
            ci->features = nci._features;
            return(ci);
        }
Exemple #3
0
        private static void Main(string[] args)
        {
            var buf = new byte[4];
              buf[0] = (byte) 0xc3;
              buf[1] = (byte) 0x33;
              buf[2] = (byte) 0xc0;
              buf[3] = (byte) 0xc3;
              var ci = new CodeInfo((long) 0x1000, buf, DecodeType.Decode32Bits, 0);
              using (var decoded = DiStorm3.Decode(ci, 10)) {
            foreach (var x in decoded.Instructions) {
              var s = String.Format("{0:X} {1} {2}", x.Offset, x.Mnemonic, x.Operands);
              Console.WriteLine(s);
            }
              }

              using (var decomposed = DiStorm3.Decompose(ci, 10)) {
            foreach (var y in decomposed.Instructions) {
              if (y.Opcode == Opcode.RET) continue;
              var x = DiStorm3.Format(ci, y);
              var s = String.Format("{0:X} {1} {2}", x.Offset, x.Mnemonic, x.Operands);
              Console.WriteLine(s);
            }
              }
        }
        public static unsafe void Decode(CodeInfo nci, DecodedResult dr)
        {
            _CodeInfo* ci = null;
              _DecodedInst* insts = null;
              var gch = new GCHandle();
              uint usedInstructionsCount = 0;

              try
              {
            if ((ci = AcquireCodeInfoStruct(nci, out gch)) == null)
              throw new OutOfMemoryException();

            var maxInstructions = dr.MaxInstructions;

            if ((insts = (_DecodedInst*) Malloc(maxInstructions*sizeof (_DecodedInst))) == null)
              throw new OutOfMemoryException();

            distorm_decode64(ci->codeOffset, ci->code, ci->codeLen, ci->dt, insts, (uint) maxInstructions,
                         &usedInstructionsCount);

            var dinsts = new DecodedInst[usedInstructionsCount];

            for (var i = 0; i < usedInstructionsCount; i++)
              dinsts[i] = CreateDecodedInstObj(&insts[i]);
            dr.Instructions = dinsts;
              }
              finally {
            /* In case of an error, jInsts will get cleaned automatically. */
            if (gch.IsAllocated)
              gch.Free();
            if (ci != null)
              Free(ci);
            if (insts != null)
              Free(insts);
              }
        }
Exemple #5
0
        public static unsafe DecodedInst Format(CodeInfo nci, DecomposedInst ndi)
        {
            var         input = new _DInst();
            _CodeInfo * ci    = null;
            var         gch   = new GCHandle();
            DecodedInst di;

            try
            {
                ci = AcquireCodeInfoStruct(nci, out gch);
                if (ci == null)
                {
                    throw new OutOfMemoryException();
                }

                input.addr    = ndi.Address;
                input.flags   = ndi.Flags;
                input.size    = (byte)ndi.Size;
                input.segment = (byte)ndi._segment;
                input.ibase   = (byte)ndi.Base;
                input.scale   = (byte)ndi.Scale;
                input.opcode  = (ushort)ndi.Opcode;
                /* unusedPrefixesMask is unused indeed, lol. */
                input.meta = (ushort)ndi.Meta;
                /* Nor usedRegistersMask. */

                int opsCount = ndi.Operands.Length;
                for (var i = 0; i < opsCount; i++)
                {
                    var op = ndi.Operands[i];
                    if (op == null)
                    {
                        continue;
                    }
                    input.ops[i].index = (byte)op.Index;
                    input.ops[i].type  = op.Type;
                    input.ops[i].size  = (ushort)op.Size;
                }

                if (ndi.Imm != null)
                {
                    input.imm.qword = ndi.Imm.Imm;
                }

                if (ndi.Disp != null)
                {
                    input.disp     = ndi.Disp.Displacement;
                    input.dispSize = (byte)ndi.Disp.Size;
                }

                _DecodedInst output;
                distorm_format64(ci, &input, &output);

                di = CreateDecodedInstObj(&output);
            }
            finally
            {
                if (gch.IsAllocated)
                {
                    gch.Free();
                }
                if (ci != null)
                {
                    Free(ci);
                }
            }
            return(di);
        }
Exemple #6
0
        public static unsafe void Decompose(CodeInfo nci, DecomposedResult ndr)
        {
            _CodeInfo *ci    = null;
            _DInst *   insts = null;
            var        gch   = new GCHandle();
            var        usedInstructionsCount = 0;

            try
            {
                if ((ci = AcquireCodeInfoStruct(nci, out gch)) == null)
                {
                    throw new OutOfMemoryException();
                }

                var maxInstructions = ndr.MaxInstructions;

                if ((insts = (_DInst *)Malloc(maxInstructions * sizeof(_DInst))) == null)
                {
                    throw new OutOfMemoryException();
                }

                distorm_decompose64(ci, insts, maxInstructions, &usedInstructionsCount);

                var dinsts = new DecomposedInst[usedInstructionsCount];

                for (var i = 0; i < usedInstructionsCount; i++)
                {
                    var di = new DecomposedInst {
                        Address            = insts[i].addr,
                        Flags              = insts[i].flags,
                        Size               = insts[i].size,
                        _segment           = insts[i].segment,
                        Base               = insts[i].ibase,
                        Scale              = insts[i].scale,
                        Opcode             = (Opcode)insts[i].opcode,
                        UnusedPrefixesMask = insts[i].unusedPrefixesMask,
                        Meta               = insts[i].meta,
                        RegistersMask      = insts[i].usedRegistersMask,
                        ModifiedFlagsMask  = insts[i].modifiedFlagsMask,
                        TestedFlagsMask    = insts[i].testedFlagsMask,
                        UndefinedFlagsMask = insts[i].undefinedFlagsMask
                    };

                    /* Simple fields: */

                    /* Immediate variant. */
                    var immVariant = new DecomposedInst.ImmVariant {
                        Imm  = insts[i].imm.qword,
                        Size = 0
                    };
                    /* The size of the immediate is in one of the operands, if at all. Look for it below. Zero by default. */

                    /* Count operands. */
                    var operandsNo = 0;
                    for (operandsNo = 0; operandsNo < _DInst.OPERANDS_NO; operandsNo++)
                    {
                        if (insts[i].ops[operandsNo].type == OperandType.None)
                        {
                            break;
                        }
                    }

                    var ops = new Operand[operandsNo];

                    for (var j = 0; j < operandsNo; j++)
                    {
                        if (insts[i].ops[j].type == OperandType.Imm)
                        {
                            /* Set the size of the immediate operand. */
                            immVariant.Size = insts[i].ops[j].size;
                        }

                        var op = new Operand {
                            Type  = insts[i].ops[j].type,
                            Index = insts[i].ops[j].index,
                            Size  = insts[i].ops[j].size
                        };

                        ops[j] = op;
                    }
                    di.Operands = ops;

                    /* Attach the immediate variant. */
                    di.Imm = immVariant;

                    /* Displacement variant. */
                    var disp = new DecomposedInst.DispVariant {
                        Displacement = insts[i].disp,
                        Size         = insts[i].dispSize
                    };

                    di.Disp   = disp;
                    dinsts[i] = di;
                }

                ndr.Instructions = dinsts;
            }
            finally
            {
                if (gch.IsAllocated)
                {
                    gch.Free();
                }
                if (ci != null)
                {
                    Free(ci);
                }
                if (insts != null)
                {
                    Free(insts);
                }
            }
        }
Exemple #7
0
        private static unsafe CodeInfoStruct* AcquireCodeInfoStruct(CodeInfo nci, out GCHandle gch)
        {
            var ci = (CodeInfoStruct*) Malloc(sizeof (CodeInfoStruct));
              if (ci == null)
            throw new OutOfMemoryException();

              Memset(ci, 0, sizeof (CodeInfoStruct));

              ci->codeOffset = new IntPtr(nci._codeOffset);

              if (nci._code == null && nci._codePtr != null && nci._codeLength > 0) {
            ci->code = nci._codePtr;
            ci->codeLen = nci._codeLength;
            gch = new GCHandle();
              }
              else {
            gch = GCHandle.Alloc(nci._code, GCHandleType.Pinned);
            ci->code = (byte*) gch.AddrOfPinnedObject().ToPointer();
            ci->codeLen = nci._code.Length;
              }
              ci->dt = nci._decodeType;
              ci->features = nci._features;
              return ci;
        }
Exemple #8
0
        public static unsafe DecodedInstruction Format(CodeInfo nci, DecomposedInstruction ndi)
        {
            var input = new DecomposedInstructionStruct();
              CodeInfoStruct *ci = null;
              var gch = new GCHandle();
              DecodedInstruction di;

              try
              {
            ci = AcquireCodeInfoStruct(nci, out gch);
            if (ci == null)
              throw new OutOfMemoryException();

            input.Address = ndi.Address;
            input.Flags = ndi.Flags;
            input.Size = (byte) ndi.Size;
            input.segment = (byte) ndi._segment;
            input.ibase = (byte) ndi.Base;
            input.scale = (byte) ndi.Scale;
            input.Opcode = ndi.Opcode;
            /* unusedPrefixesMask is unused indeed, lol. */
            input.meta = (byte) ndi.Meta;
            /* Nor usedRegistersMask. */

            int opsCount = ndi.Operands.Length;
            for (var i = 0; i < opsCount; i++) {
              var op = ndi.Operands[i];
              if (op == null) continue;
              input.Operands[i].index = (byte) op.Index;
              input.Operands[i].Type = op.Type;
              input.Operands[i].Size = (ushort) op.Size;
            }

            if (ndi.ImmediateValue != null)
              input.ImmediateValue = ndi.ImmediateValue.ImmediateValue;

            if (ndi.Displacement != null)
            {
              input.Displacement = ndi.Displacement.Displacement;
              input.dispSize = (byte) ndi.Displacement.Size;
            }

            DecodedInstructionStruct output;
            distorm_format64(ci, &input, &output);

            di = DecodedInstruction.FromUnsafe(&output);
              }
              finally
              {
            if (gch.IsAllocated)
              gch.Free();
            if (ci != null)
              Free(ci);
              }
              return di;
        }
Exemple #9
0
        public static unsafe DecomposedResult Decompose(CodeInfo nci, int maxInstructions)
        {
            CodeInfoStruct* ci = null;
              DecomposedInstructionStruct* insts = null;
              var gch = new GCHandle();
              var usedInstructionsCount = 0;

              try {
            if ((ci = AcquireCodeInfoStruct(nci, out gch)) == null)
              throw new OutOfMemoryException();

            var dr = new DecomposedResult(maxInstructions);

            distorm_decompose64(ci, dr.InstructionsPointer, maxInstructions, &usedInstructionsCount);
            dr.UsedInstructions = usedInstructionsCount;
            return dr;
              }
              finally
              {
            if (gch.IsAllocated)
              gch.Free();
            if (ci != null)
              Free(ci);
              }
        }
Exemple #10
0
        public static unsafe DecodedResult Decode(CodeInfo nci, int maxInstructions)
        {
            var gch = new GCHandle();
              uint usedInstructionsCount = 0;
              CodeInfoStruct* ci = null;
              try {

            ci = AcquireCodeInfoStruct(nci, out gch);
            var dr = new DecodedResult(maxInstructions);

            distorm_decode64(ci->codeOffset, ci->code, ci->codeLen, ci->dt, dr.InstructionsPointer, (uint) maxInstructions, &usedInstructionsCount);

            dr.UsedInstructionCount = (int) usedInstructionsCount;
            return dr;
              }
              finally {
            if (gch.IsAllocated)
              gch.Free();
            if (ci != null)
              Free(ci);
              }
        }
Exemple #11
0
    public static unsafe DecodedInst Format(CodeInfo nci, DecomposedInst ndi)
    {    	
      var input = new _DInst();
      _CodeInfo *ci = null;
      var gch = new GCHandle();
      DecodedInst di;

      try
      {
        ci = AcquireCodeInfoStruct(nci, out gch);
        if (ci == null)
          throw new OutOfMemoryException();

        input.addr = ndi.Address;
        input.flags = ndi.Flags;
        input.size = (byte) ndi.Size;
        input.segment = (byte) ndi._segment;
        input.ibase = (byte) ndi.Base;
        input.scale = (byte) ndi.Scale;
        input.opcode = (ushort) ndi.Opcode;
        /* unusedPrefixesMask is unused indeed, lol. */
        input.meta = (byte) ndi.Meta;
        /* Nor usedRegistersMask. */

        int opsCount = ndi.Operands.Length;        
        for (var i = 0; i < opsCount; i++) {
          var op = ndi.Operands[i];
          if (op == null) continue;
          input.ops[i].index = (byte) op.Index;
          input.ops[i].type = op.Type;
          input.ops[i].size = (ushort) op.Size;
        }

        if (ndi.Imm != null)
          input.imm.qword = ndi.Imm.Imm;

        if (ndi.Disp != null)
        {
          input.disp = ndi.Disp.Displacement;
          input.dispSize = (byte) ndi.Disp.Size;
        }

        _DecodedInst output;
        distorm_format64(ci, &input, &output);

        di = CreateDecodedInstObj(&output);
      }
      finally
      {
        if (gch.IsAllocated)
          gch.Free();
        if (ci != null)
          Free(ci);
      }
      return di;
    }
Exemple #12
0
    public static unsafe void Decompose(CodeInfo nci, DecomposedResult ndr)
    {	    
	    _CodeInfo* ci = null;
      _DInst* insts = null;
      var gch = new GCHandle();
      var usedInstructionsCount = 0;

      try
      {
        if ((ci = AcquireCodeInfoStruct(nci, out gch)) == null)        
          throw new OutOfMemoryException();

        var maxInstructions = ndr.MaxInstructions;

        if ((insts = (_DInst*) Malloc(maxInstructions*sizeof (_DInst))) == null)
          throw new OutOfMemoryException();

        distorm_decompose64(ci, insts, maxInstructions, &usedInstructionsCount);

        var dinsts = new DecomposedInst[usedInstructionsCount];

        for (var i = 0; i < usedInstructionsCount; i++) {
          var di = new DecomposedInst {
            Address = insts[i].addr,
            Flags = insts[i].flags,
            Size = insts[i].size,
            _segment = insts[i].segment,
            Base = insts[i].ibase,
            Scale = insts[i].scale,
            Opcode = (Opcode) insts[i].opcode,
            UnusedPrefixesMask = insts[i].unusedPrefixesMask,
            Meta = insts[i].meta,
            RegistersMask = insts[i].usedRegistersMask,
            ModifiedFlagsMask = insts[i].modifiedFlagsMask,
            TestedFlagsMask = insts[i].testedFlagsMask,
            UndefinedFlagsMask = insts[i].undefinedFlagsMask
          };

          /* Simple fields: */

          /* Immediate variant. */
          var immVariant = new DecomposedInst.ImmVariant {
            Imm = insts[i].imm.qword, 
            Size = 0
          };
          /* The size of the immediate is in one of the operands, if at all. Look for it below. Zero by default. */

          /* Count operands. */
          var operandsNo = 0;
          for (operandsNo = 0; operandsNo < _DInst.OPERANDS_NO; operandsNo++)
          {
            if (insts[i].ops[operandsNo].type == OperandType.None)
              break;
          }

          var ops = new Operand[operandsNo];

          for (var j = 0; j < operandsNo; j++)
          {
            if (insts[i].ops[j].type == OperandType.Imm) {
              /* Set the size of the immediate operand. */
              immVariant.Size = insts[i].ops[j].size;
            }

            var op = new Operand {
              Type = insts[i].ops[j].type,
              Index = insts[i].ops[j].index,
              Size = insts[i].ops[j].size
            };

            ops[j] = op;
          }
          di.Operands = ops;

          /* Attach the immediate variant. */
          di.Imm = immVariant;

          /* Displacement variant. */
          var disp = new DecomposedInst.DispVariant {
            Displacement = insts[i].disp,
            Size = insts[i].dispSize
          };

          di.Disp = disp;
          dinsts[i] = di;
        }

        ndr.Instructions = dinsts;
      }
      finally
      {
        if (gch.IsAllocated)
          gch.Free();
        if (ci != null)
          Free(ci);
        if (insts != null)
          Free(insts);
      }
    }