예제 #1
0
        private static bool FuncFind(Stream onstream, asmChunk fromfunction, uint required_stacksize, bool backwards, out asmInstruction found)
        {
            asmChunk curfunc;

            found = null;
            while (fromfunction.FindByType(x86_insn_type.insn_call, backwards, out found))
            {
                onstream.Position = found.ReadAddressOperand();
                curfunc           = disassembler.disassemble_chunk(onstream);
                if (StackSize(curfunc) == required_stacksize)
                {
                    return(true);
                }
                fromfunction.MoveNext();
            }
            return(false);
        }
예제 #2
0
        private static uint StackSize(asmChunk tocheck)
        {
            asmOperand     curop;
            asmInstruction found;

            tocheck.ToStart();
            if (tocheck.FindByType(x86_insn_type.insn_return, false, out found))
            {
                for (int i = 0; i < found.Operands.Count; i++)
                {
                    curop = found.Operands[i];
                    if (curop.Type == x86_op_type.op_immediate)
                    {
                        return((uint)curop.Data);
                    }
                }
            }
            return(0);
        }