예제 #1
0
 public static extern void distorm_format(ref _CodeInfo ci, ref _DInst di, ref _DecodedInst result);
예제 #2
0
 /// <summary>
 /// Sets the address size in the flags value of an instruction.
 /// </summary>
 /// <param name="di">The instruction that will have its flags value modified.</param>
 /// <param name="size">The new size of the address.</param>
 /// <remarks>This is the FLAG_SET_ADDRSIZE macro in distorm.h.</remarks>
 public static void FlagSetAddrSize(_DInst di, byte size)
 {
     di.flags |= (ushort)((size & 3) << 10);
 }
예제 #3
0
 /// <summary>
 /// Sets the segment value of an instruction.
 /// </summary>
 /// <param name="di">The instruction that will have its segment value set.</param>
 /// <param name="segment">The value to set which the instruction's segment value will be set.</param>
 /// <remarks>This is the SEGMENT_SET macro in distorm.h.</remarks>
 public static void SegmentSet(_DInst di, byte segment)
 {
     di.segment |= segment;
 }
예제 #4
0
 /// <summary>
 /// Get the target address of a branching instruction.
 /// </summary>
 /// <param name="di">A decomposed instruction, specifically some type of a branch instruction.</param>
 /// <returns>Returns the target address of the branch.</returns>
 /// <remarks>This is the INSTRUCTION_GET_TARGET macro in distorm.h</remarks>
 public static ulong InstructionGetTarget(_DInst di)
 {
     return(di.addr + di.imm.addr + di.size);
 }
예제 #5
0
 /// <summary>
 /// Get the target address of a RIP-relative memory indirection.
 /// </summary>
 /// <param name="di">A decomposed instruction.</param>
 /// <returns>Returns the target address of a RIP-relative memory indirection.</returns>
 /// <remarks>This is the INSTRUCTION_GET_RIP_TARGET macro in distorm.h.</remarks>
 public static ulong InstructionGetRipTarget(_DInst di)
 {
     return(di.addr + di.disp + di.size);
 }
예제 #6
0
        public static unsafe DecodedInst Format(CodeInfo nci, DecomposedInst ndi)
        {
            var         input = new _DInst();
            _CodeInfo * ci    = null;
            var         gch   = new GCHandle();
            DecodedInst di;

            try
            {
                ci = AcquireCodeInfoStruct(nci, out gch);
                if (ci == null)
                {
                    throw new OutOfMemoryException();
                }

                input.addr    = ndi.Address;
                input.flags   = ndi.Flags;
                input.size    = (byte)ndi.Size;
                input.segment = (byte)ndi._segment;
                input.ibase   = (byte)ndi.Base;
                input.scale   = (byte)ndi.Scale;
                input.opcode  = (ushort)ndi.Opcode;
                /* unusedPrefixesMask is unused indeed, lol. */
                input.meta = (ushort)ndi.Meta;
                /* Nor usedRegistersMask. */

                int opsCount = ndi.Operands.Length;
                for (var i = 0; i < opsCount; i++)
                {
                    var op = ndi.Operands[i];
                    if (op == null)
                    {
                        continue;
                    }
                    input.ops[i].index = (byte)op.Index;
                    input.ops[i].type  = op.Type;
                    input.ops[i].size  = (ushort)op.Size;
                }

                if (ndi.Imm != null)
                {
                    input.imm.qword = ndi.Imm.Imm;
                }

                if (ndi.Disp != null)
                {
                    input.disp     = ndi.Disp.Displacement;
                    input.dispSize = (byte)ndi.Disp.Size;
                }

                _DecodedInst output;
                distorm_format64(ci, &input, &output);

                di = CreateDecodedInstObj(&output);
            }
            finally
            {
                if (gch.IsAllocated)
                {
                    gch.Free();
                }
                if (ci != null)
                {
                    Free(ci);
                }
            }
            return(di);
        }
예제 #7
0
 /// <summary>
 /// Set the Instruction-Set-Class type of the instruction.
 /// </summary>
 /// <param name="di">The instruction that will have its meta value set.</param>
 /// <param name="isc">The Instruction-Set-Class type to set to the meta value.</param>
 public static void MetaSetISC(_DInst di, short isc)
 {
     di.meta |= (byte)(isc << 3);
 }
예제 #8
0
 /// <summary>
 /// Sets the segment value of an instruction.
 /// </summary>
 /// <param name="di">The instruction that will have its segment value set.</param>
 /// <param name="segment">The value to set which the instruction's segment value will be set.</param>
 /// <remarks>This is the SEGMENT_SET macro in distorm.h.</remarks>
 public static void SegmentSet(_DInst di, byte segment)
 {
     di.segment |= segment;
 }
예제 #9
0
 public static extern void distorm_format(ref _CodeInfo ci, ref _DInst di, ref _DecodedInst result);
예제 #10
0
 /// <summary>
 /// Sets the address size in the flags value of an instruction.
 /// </summary>
 /// <param name="di">The instruction that will have its flags value modified.</param>
 /// <param name="size">The new size of the address.</param>
 /// <remarks>This is the FLAG_SET_ADDRSIZE macro in distorm.h.</remarks>
 public static void FlagSetAddrSize(_DInst di, byte size)
 {
     di.flags |= (ushort)((size & 3) << 10);
 }
예제 #11
0
 /// <summary>
 /// Get the target address of a RIP-relative memory indirection.
 /// </summary>
 /// <param name="di">A decomposed instruction.</param>
 /// <returns>Returns the target address of a RIP-relative memory indirection.</returns>
 /// <remarks>This is the INSTRUCTION_GET_RIP_TARGET macro in distorm.h.</remarks>
 public static ulong InstructionGetRipTarget(_DInst di)
 {
     return di.addr + di.disp + di.size;
 }
예제 #12
0
 /// <summary>
 /// Get the target address of a branching instruction.
 /// </summary>
 /// <param name="di">A decomposed instruction, specifically some type of a branch instruction.</param>
 /// <returns>Returns the target address of the branch.</returns>
 /// <remarks>This is the INSTRUCTION_GET_TARGET macro in distorm.h</remarks>
 public static ulong InstructionGetTarget(_DInst di)
 {
     return di.addr + di.imm.addr + di.size;
 }
예제 #13
0
 /// <summary>
 /// Set the Instruction-Set-Class type of the instruction.
 /// </summary>
 /// <param name="di">The instruction that will have its meta value set.</param>
 /// <param name="isc">The Instruction-Set-Class type to set to the meta value.</param>
 public static void MetaSetISC(_DInst di, short isc)
 {
     di.meta |= (byte)(isc << 3);
 }
예제 #14
0
파일: diStorm3.cs 프로젝트: m0n0ph1/distorm
    public static unsafe DecodedInst Format(CodeInfo nci, DecomposedInst ndi)
    {    	
      var input = new _DInst();
      _CodeInfo *ci = null;
      var gch = new GCHandle();
      DecodedInst di;

      try
      {
        ci = AcquireCodeInfoStruct(nci, out gch);
        if (ci == null)
          throw new OutOfMemoryException();

        input.addr = ndi.Address;
        input.flags = ndi.Flags;
        input.size = (byte) ndi.Size;
        input.segment = (byte) ndi._segment;
        input.ibase = (byte) ndi.Base;
        input.scale = (byte) ndi.Scale;
        input.opcode = (ushort) ndi.Opcode;
        /* unusedPrefixesMask is unused indeed, lol. */
        input.meta = (byte) ndi.Meta;
        /* Nor usedRegistersMask. */

        int opsCount = ndi.Operands.Length;        
        for (var i = 0; i < opsCount; i++) {
          var op = ndi.Operands[i];
          if (op == null) continue;
          input.ops[i].index = (byte) op.Index;
          input.ops[i].type = op.Type;
          input.ops[i].size = (ushort) op.Size;
        }

        if (ndi.Imm != null)
          input.imm.qword = ndi.Imm.Imm;

        if (ndi.Disp != null)
        {
          input.disp = ndi.Disp.Displacement;
          input.dispSize = (byte) ndi.Disp.Size;
        }

        _DecodedInst output;
        distorm_format64(ci, &input, &output);

        di = CreateDecodedInstObj(&output);
      }
      finally
      {
        if (gch.IsAllocated)
          gch.Free();
        if (ci != null)
          Free(ci);
      }
      return di;
    }