コード例 #1
0
        public Disassembler(VM target)
            : base("Disassembler", Handle.GetContextByID(target.HandleID).DeepCopy(), HandleParameters.DISASSEMBLE | HandleParameters.NOJMP | HandleParameters.NOBREAK)
        {
            // Target will hold a reference to the VM
            Target = target;

            // Create a new address range to disassemble(the loaded instructions)
            Map = new AddressMap();
            Map.AddRange(new AddressRange(Target.GetMemory().SegmentMap[".main"].Range.Start, Target.GetMemory().SegmentMap[".main"].Range.End));

            // When the target VM calls flash(), the context reference will change, so it is necessary to listen for this and update accordingly.
            target.Flash += UpdateTarget;

            // When the target finishes execution, update the address marked as RIP and the new RIP.
            target.RunComplete += (status) =>
            {
                // These conditions will only pass if the address is present. It would be perfectly normal for it not to,
                // for example when all the instructions have been executed, $RIP is out of the disassembly.
                if ((Map.Search(status.InitialRIP).Info | AddressMap.BinarySearchResult.ResultInfo.PRESENT) == Map.Search(status.InitialRIP).Info)
                {
                    ToggleSetting(status.InitialRIP, AddressInfo.RIP);
                }
                if ((Map.Search(status.EndRIP).Info | AddressMap.BinarySearchResult.ResultInfo.PRESENT) == Map.Search(status.InitialRIP).Info)
                {
                    ToggleSetting(status.EndRIP, AddressInfo.RIP);
                }
            };

            // Listen for changes to breakpoints on the target VM.
            target.Breakpoints.OnAdd    += (addr, index) => ToggleSetting(addr, AddressInfo.BREAKPOINT);
            target.Breakpoints.OnRemove += (addr, index) => ToggleSetting(addr, AddressInfo.BREAKPOINT);
        }
コード例 #2
0
 public void ClearAddressRange()
 {
     // When clearing the range, make sure that the initial code segment is added back to the address ranges. This would be called
     // for example when new instructions are loaded onto the VM. The disassembler will have to adjust the ranges it disassembled to
     // match new code.
     Map.Clear();
     Map.AddRange(new AddressRange(Target.GetMemory().SegmentMap[".main"].Range.Start, Target.GetMemory().SegmentMap[".main"].Range.End));
 }