Esempio n. 1
0
        public static unsafe DecomposedResult Decompose(CodeInfo nci, int maxInstructions)
        {
            CodeInfoStruct *ci = null;
            DecomposedInstructionStruct *insts = null;
            var gch = new GCHandle();
            var usedInstructionsCount = 0;

            try {
                if ((ci = AcquireCodeInfoStruct(nci, out gch)) == null)
                {
                    throw new OutOfMemoryException();
                }

                var dr = new DecomposedResult(maxInstructions);

                distorm_decompose64(ci, dr.InstructionsPointer, maxInstructions, &usedInstructionsCount);
                dr.UsedInstructions = usedInstructionsCount;
                return(dr);
            }
            finally
            {
                if (gch.IsAllocated)
                {
                    gch.Free();
                }
                if (ci != null)
                {
                    Free(ci);
                }
            }
        }
Esempio n. 2
0
        public static unsafe DecodedResult Decode(CodeInfo nci, int maxInstructions)
        {
            var             gch = new GCHandle();
            uint            usedInstructionsCount = 0;
            CodeInfoStruct *ci = null;

            try {
                ci = AcquireCodeInfoStruct(nci, out gch);
                var dr = new DecodedResult(maxInstructions);

                distorm_decode64(ci->codeOffset, ci->code, ci->codeLen, ci->dt, dr.InstructionsPointer, (uint)maxInstructions, &usedInstructionsCount);

                dr.UsedInstructionCount = (int)usedInstructionsCount;
                return(dr);
            }
            finally {
                if (gch.IsAllocated)
                {
                    gch.Free();
                }
                if (ci != null)
                {
                    Free(ci);
                }
            }
        }
Esempio n. 3
0
        public static unsafe DecodedInstruction Format(CodeInfo nci, DecomposedInstruction ndi)
        {
            var                input = new DecomposedInstructionStruct();
            CodeInfoStruct *   ci    = null;
            var                gch   = new GCHandle();
            DecodedInstruction di;

            try
            {
                ci = AcquireCodeInfoStruct(nci, out gch);
                if (ci == null)
                {
                    throw new OutOfMemoryException();
                }

                input.Address = ndi.Address;
                input.Flags   = ndi.Flags;
                input.Size    = (byte)ndi.Size;
                input.segment = (byte)ndi._segment;
                input.ibase   = (byte)ndi.Base;
                input.scale   = (byte)ndi.Scale;
                input.Opcode  = ndi.Opcode;
                /* unusedPrefixesMask is unused indeed, lol. */
                input.meta = (byte)ndi.Meta;
                /* Nor usedRegistersMask. */

                int opsCount = ndi.Operands.Length;
                for (var i = 0; i < opsCount; i++)
                {
                    var op = ndi.Operands[i];
                    if (op == null)
                    {
                        continue;
                    }
                    input.Operands[i].index = (byte)op.Index;
                    input.Operands[i].Type  = op.Type;
                    input.Operands[i].Size  = (ushort)op.Size;
                }

                if (ndi.ImmediateValue != null)
                {
                    input.ImmediateValue = ndi.ImmediateValue.ImmediateValue;
                }

                if (ndi.Displacement != null)
                {
                    input.Displacement = ndi.Displacement.Displacement;
                    input.dispSize     = (byte)ndi.Displacement.Size;
                }

                DecodedInstructionStruct output;
                distorm_format64(ci, &input, &output);

                di = DecodedInstruction.FromUnsafe(&output);
            }
            finally
            {
                if (gch.IsAllocated)
                {
                    gch.Free();
                }
                if (ci != null)
                {
                    Free(ci);
                }
            }
            return(di);
        }