public InstructionWithAddressOperandTransform(IInstructionWithAddressOperandDecider InstructionWithAddressOperandDecider,
                                               IDisassemblerFactory disasmFactory)
 {
     m_InstructionWithAddressOperandDecider = InstructionWithAddressOperandDecider ?? throw new ArgumentNullException(nameof(InstructionWithAddressOperandDecider));
     m_disasmFactory = disasmFactory ?? throw new ArgumentNullException(nameof(disasmFactory));
     m_dictionaryJumpInstructionBytes = FillDictionaryJumpInstructionBytes();
     m_dictionaryOfJumpToNegativeJump = FillDictionaryOfJumpToNegativeJump();
 }
Exemplo n.º 2
0
 public CodeParser(IFunctionParser functionParser, ICodeFactory codeFactory,
                   IDisassemblerFactory disassemblerFactory,
                   IInstructionWithAddressOperandDecider jumpTargetAddressDecider)
 {
     m_functionParser           = functionParser ?? throw new ArgumentNullException(nameof(functionParser));
     m_codeFactory              = codeFactory ?? throw new ArgumentNullException(nameof(codeFactory));
     m_disassemblerFactory      = disassemblerFactory ?? throw new ArgumentNullException(nameof(disassemblerFactory));
     m_jumpTargetAddressDecider = jumpTargetAddressDecider ?? throw new ArgumentNullException(nameof(jumpTargetAddressDecider));
 }
 public TransformationAddingJunkBytes(IInstructionWithAddressOperandDecider instructionWithAddressOperandDecider,
                                      IInstructionWithAddressOperandTransform instructionWithAddressOperandTransform,
                                      ICodeInMemoryLayoutFactory codeInMemoryLayoutFactory,
                                      ICodeFactory codeFactory,
                                      IInstructionWithAddressOperandTransform jumpInstrucionTransform,
                                      ICodeTransform codeTransform,
                                      IStatistics statistics,
                                      IRelocationDirectoryFromNewCode relocationDirectoryFromNewCode,
                                      IJunkBytesProvider junkBytesProvider,
                                      IDisassemblerFactory disassemblerFactory) :
     base(instructionWithAddressOperandDecider, instructionWithAddressOperandTransform,
          codeFactory, codeInMemoryLayoutFactory, codeTransform, statistics,
          relocationDirectoryFromNewCode)
 {
     m_junkBytesProvider   = junkBytesProvider ?? throw new ArgumentNullException(nameof(junkBytesProvider));
     m_disassemblerFactory = disassemblerFactory ?? throw new ArgumentNullException(nameof(disassemblerFactory));
 }
        /// <summary>
        /// Find the first instrucion index that is not affected by the junk insertion in the new block.
        /// In other words: it Finds the first instruction in the new block which is identical to instruction
        /// in the original basic block. the identical instruction start an identical sequence of instructions
        /// untill the end of the two blocks.
        /// </summary>
        /// <param name="newBasicBlockBytes">new basic block bytes</param>
        /// <param name="basicBlock">original basic block</param>
        /// <param name="disassemblerFactory">diassembler factory</param>
        /// <returns>the first index of unaffected instruction in the original basic block, or not o value otherwise</returns>
        private uint?CompareDisassembleToOriginal(byte[] newBasicBlockBytes, IBasicBlock basicBlock,
                                                  IDisassemblerFactory disassemblerFactory)
        {
            //disassemble new bytes after junk have been inserted
            var           newAssemblyInstructions = new List <IAssemblyInstructionForTransformation>();
            IDisassembler disasm = disassemblerFactory.Create(newBasicBlockBytes);

            foreach (var instruction in disasm.Disassemble())
            {
                newAssemblyInstructions.Add(instruction);
            }

            //not enought instruction have been decoded right in this block!
            if (newAssemblyInstructions.Count <= 1)
            {
                return(null);
            }

            //compare to original basic block instructions
            //start from index 1 because first instruction is the inserted junk...
            for (int i = 1; i < newAssemblyInstructions.Count(); i++)
            {
                for (int j = 0; j < basicBlock.AssemblyInstructions.Count; j++)
                {
                    //compare instruction until the end if they are equal
                    if (newAssemblyInstructions[i].BytesEquals(basicBlock.AssemblyInstructions[j]))
                    {
                        if (instructionAreIdenticalUntilTheEnd(newAssemblyInstructions, i + 1, basicBlock.AssemblyInstructions, j + 1))
                        {
                            return((uint?)j);
                        }
                    }
                }
            }

            return(null);
        }