コード例 #1
0
ファイル: Environment.cs プロジェクト: arkanoid1/OpcodeDumper
        public static Emulator Create(Stream file)
        {
            var binary = new BinaryReader(file); // Can't using it.

            var emu = new Emulator(0, 0x32000000);
            emu.PeInfo = new PeHeaderReader((file as FileStream).Name);

            // Load .text
            var code = emu.PeInfo.TEXT;
            binary.BaseStream.Seek(code.PhysicalAddress, SeekOrigin.Begin);
            for (uint i = 0; i < code.SizeOfRawData; ++i)
                emu.WriteByteToMemory(code.VirtualAddress + i + emu.PeInfo.OptionalHeader32.ImageBase, binary.ReadByte());

            var data = emu.PeInfo.DATA;
            binary.BaseStream.Seek(data.PhysicalAddress, SeekOrigin.Begin);
            for (uint i = 0; i < data.SizeOfRawData; ++i)
                emu.WriteByteToMemory(data.VirtualAddress + i + emu.PeInfo.OptionalHeader32.ImageBase, binary.ReadByte());

            var rodata = emu.PeInfo.RODATA;
            binary.BaseStream.Seek(rodata.PhysicalAddress, SeekOrigin.Begin);
            for (uint i = 0; i < rodata.SizeOfRawData; ++i)
                emu.WriteByteToMemory(rodata.VirtualAddress + i + emu.PeInfo.OptionalHeader32.ImageBase, binary.ReadByte());

            var rdata = emu.PeInfo.RDATA;
            binary.BaseStream.Seek(rdata.PhysicalAddress, SeekOrigin.Begin);
            for (uint i = 0; i < rdata.SizeOfRawData; ++i)
                emu.WriteByteToMemory(rdata.VirtualAddress + i + emu.PeInfo.OptionalHeader32.ImageBase, binary.ReadByte());
            return emu;
        }
コード例 #2
0
ファイル: Program.cs プロジェクト: arkanoid1/OpcodeDumper
        static void Main(string[] args)
        {
            Console.WriteLine(">> Loading configuration options...");
            if (!Config.Load(args))
                return;

            if (Config.NoCmsg && Config.NoSmsg)
            {
                Logger.WriteConsoleLine("Please give me something to do.");
                Config.ShowHelp();
                return;
            }

            Logger.CreateOutputStream(Config.OutputFile);

            Console.WriteLine(">> Opening Wow client...");
            ClientStream = new BinaryReader(File.OpenRead(Config.Executable));
            if (!BaseStream.CanRead)
                return;

            ClientBytes = File.ReadAllBytes(Config.Executable);
            Disasm = new UnmanagedBuffer(ClientBytes);
            Env = Emulator.Create(BaseStream);

            if (!Config.NoSmsg)
            {
                Console.WriteLine(">> Discovering JAM groups...");
                foreach (var pattern in ClientGroupPatterns) // Load jam groups...
                {
                    var offsets = ClientBytes.FindPattern(pattern, 0xFF);
                    if (offsets.Count == 0)
                    {
                        Console.WriteLine(@"Could not find group name "" {0}""", System.Text.Encoding.ASCII.GetString(pattern.Skip(1).ToArray()));
                        return;
                    }
                    else
                    {
                        Console.WriteLine(@"Found JAM Group "" {0}""", System.Text.Encoding.ASCII.GetString(pattern.Skip(1).ToArray()));
                        Dispatchers.Add(new JamDispatch((int)(offsets[0] + 1)));
                    }
                }
            }

            if (!Config.NoGhNames && !Opcodes.TryPopulate())
                return;

            if (!Config.NoSmsg)
                SMSG.Dump();

            if (!Config.NoCmsg)
                CMSG.Dump(Config.SpecificOpcodeValue);
        }
コード例 #3
0
        /// <summary>
        ///
        /// </summary>
        /// <param name="arg"></param>
        public InstructionArgument(Emulator env, string arg)
        {
            this.env = env;
            arg      = arg.Trim();

            if (arg.Contains("ptr"))
            {
                // get argument size
                // todo: default to dword if no size is specified
                if (arg.StartsWith("byte ptr ["))
                {
                    Size = 1;
                }
                else if (arg.StartsWith("word ptr ["))
                {
                    Size = 2;
                }
                else if (arg.StartsWith("dword ptr ["))
                {
                    Size = 4;
                }
                else if (arg.StartsWith("fword ptr ["))
                {
                    Size = 4;                                     // NYI
                }
                else
                {
                    throw new ArgumentException();
                }

                int lbi = arg.IndexOf('[');
                int rbi = arg.IndexOf(']');
                if (lbi > -1 && rbi > -1 && rbi > lbi)
                {
                    // get string inside brackets
                    string ptr = arg.Substring(lbi + 1, rbi - lbi - 1);

                    // replace registers with the values contained within
                    ptr = ptr.Replace("eax", env.Eax.Value.ToString());
                    ptr = ptr.Replace("ebx", env.Ebx.Value.ToString());
                    ptr = ptr.Replace("ecx", env.Ecx.Value.ToString());
                    ptr = ptr.Replace("edx", env.Edx.Value.ToString());
                    ptr = ptr.Replace("esi", env.Esi.Value.ToString());
                    ptr = ptr.Replace("edi", env.Edi.Value.ToString());
                    ptr = ptr.Replace("esp", env.Esp.Value.ToString());
                    ptr = ptr.Replace("ebp", env.Ebp.Value.ToString());
                    ptr = ptr.Replace("ax", env.Eax.Ax.ToString());
                    ptr = ptr.Replace("bx", env.Ebx.Bx.ToString());
                    ptr = ptr.Replace("cx", env.Ecx.Cx.ToString());
                    ptr = ptr.Replace("dx", env.Edx.Dx.ToString());
                    ptr = ptr.Replace("si", env.Esi.Si.ToString());
                    ptr = ptr.Replace("di", env.Edi.Di.ToString());
                    ptr = ptr.Replace("sp", env.Esp.Sp.ToString());
                    ptr = ptr.Replace("bp", env.Ebp.Bp.ToString());
                    ptr = ptr.Replace("al", env.Eax.Al.ToString());
                    ptr = ptr.Replace("ah", env.Eax.Ah.ToString());
                    ptr = ptr.Replace("bl", env.Ebx.Bl.ToString());
                    ptr = ptr.Replace("bh", env.Ebx.Bh.ToString());
                    ptr = ptr.Replace("cl", env.Ecx.Cl.ToString());
                    ptr = ptr.Replace("ch", env.Ecx.Ch.ToString());
                    ptr = ptr.Replace("dl", env.Edx.Dl.ToString());
                    ptr = ptr.Replace("dh", env.Edx.Dh.ToString());

                    // evaluate the resulting expression
                    Address = Expression.Evaluate(ptr);
                }
                else
                {
                    throw new ArgumentException();
                }

                Type = ArgumentType.Memory;
            }
            else if (arg == "eax")
            {
                Register     = env.Eax;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.Full;
                RegisterName = "eax";
                Size         = 4;
            }
            else if (arg == "ax")
            {
                Register     = env.Eax;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowWord;
                RegisterName = "ax";
                Size         = 2;
            }
            else if (arg == "ah")
            {
                Register     = env.Eax;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.HighByte;
                RegisterName = "ah";
                Size         = 1;
            }
            else if (arg == "al")
            {
                Register     = env.Eax;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowByte;
                RegisterName = "al";
                Size         = 1;
            }
            else if (arg == "ebx")
            {
                Register     = env.Ebx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.Full;
                RegisterName = "ebx";
                Size         = 4;
            }
            else if (arg == "bx")
            {
                Register     = env.Ebx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowWord;
                RegisterName = "bx";
                Size         = 2;
            }
            else if (arg == "bh")
            {
                Register     = env.Ebx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.HighByte;
                RegisterName = "bh";
                Size         = 1;
            }
            else if (arg == "bl")
            {
                Register     = env.Ebx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowByte;
                RegisterName = "bl";
                Size         = 1;
            }
            else if (arg == "ecx")
            {
                Register     = env.Ecx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.Full;
                RegisterName = "ecx";
                Size         = 4;
            }
            else if (arg == "cx")
            {
                Register     = env.Ecx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowWord;
                RegisterName = "cx";
                Size         = 2;
            }
            else if (arg == "ch")
            {
                Register     = env.Ecx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.HighByte;
                RegisterName = "ch";
                Size         = 1;
            }
            else if (arg == "cl")
            {
                Register     = env.Ecx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowByte;
                RegisterName = "cl";
                Size         = 1;
            }
            else if (arg == "edx")
            {
                Register     = env.Edx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.Full;
                RegisterName = "edx";
                Size         = 4;
            }
            else if (arg == "dx")
            {
                Register     = env.Edx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowWord;
                RegisterName = "dx";
                Size         = 2;
            }
            else if (arg == "dh")
            {
                Register     = env.Edx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.HighByte;
                RegisterName = "dh";
                Size         = 1;
            }
            else if (arg == "dl")
            {
                Register     = env.Edx;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowByte;
                RegisterName = "dl";
                Size         = 1;
            }
            else if (arg == "esi")
            {
                Register     = env.Esi;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.Full;
                RegisterName = "esi";
                Size         = 4;
            }
            else if (arg == "si")
            {
                Register     = env.Esi;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowWord;
                RegisterName = "si";
                Size         = 2;
            }
            else if (arg == "edi")
            {
                Register     = env.Edi;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.Full;
                RegisterName = "edi";
                Size         = 4;
            }
            else if (arg == "di")
            {
                Register     = env.Edi;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowWord;
                RegisterName = "di";
                Size         = 2;
            }
            else if (arg == "esp")
            {
                Register     = env.Esp;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.Full;
                RegisterName = "esp";
                Size         = 4;
            }
            else if (arg == "sp")
            {
                Register     = env.Esp;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowWord;
                RegisterName = "sp";
                Size         = 2;
            }
            else if (arg == "ebp")
            {
                Register     = env.Ebp;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.Full;
                RegisterName = "ebp";
                Size         = 4;
            }
            else if (arg == "bp")
            {
                Register     = env.Ebp;
                Type         = ArgumentType.Register;
                RegisterType = x86.RegisterSubType.LowWord;
                RegisterName = "bp";
                Size         = 2;
            }
            else
            {
                Type = ArgumentType.Immediate;

                // get immediate value
                if (arg.EndsWith("h"))
                {
                    Immediate = Convert.ToUInt32(arg.Substring(0, arg.Length - 1), 16);
                }
                else
                {
                    Immediate = Convert.ToUInt32(arg);
                }

                // get immediate size
                if ((uint)Immediate < byte.MaxValue)
                {
                    Size = 1;
                }
                else if ((uint)Immediate < ushort.MaxValue)
                {
                    Size = 2;
                }
                else
                {
                    Size = 4;
                }
            }
        }