コード例 #1
0
        private KnownStackLayout GetThreadLayout(IGlobalExpressionEvaluator evaluator)
        {
            if (!_StackLayout.HasValue)
            {
                var  insns = evaluator.DisassembleMemory("SVC_ContextSave", 10) ?? new SimpleInstruction[0];
                bool hasFP = false;
                //This is a basic check to distinguish between known stack layouts. It is not trying to actually reconstruct the stack layout by analyzing the disassembly.
                foreach (var insn in insns)
                {
                    if (insn.Text?.ToLower()?.Contains("vstmdbeq") == true)
                    {
                        hasFP = true;
                        break;
                    }

                    if (insn.Text?.ToLower()?.StartsWith("bl") == true)
                    {
                        break;
                    }
                }

                _StackLayout = hasFP ? KnownStackLayout.IntegralWithOptionalFP : KnownStackLayout.IntegralOnly;
            }

            return(_StackLayout.Value);
        }