public InstructionWithAddressOperandTransform(IInstructionWithAddressOperandDecider InstructionWithAddressOperandDecider, IDisassemblerFactory disasmFactory) { m_InstructionWithAddressOperandDecider = InstructionWithAddressOperandDecider ?? throw new ArgumentNullException(nameof(InstructionWithAddressOperandDecider)); m_disasmFactory = disasmFactory ?? throw new ArgumentNullException(nameof(disasmFactory)); m_dictionaryJumpInstructionBytes = FillDictionaryJumpInstructionBytes(); m_dictionaryOfJumpToNegativeJump = FillDictionaryOfJumpToNegativeJump(); }
public CodeParser(IFunctionParser functionParser, ICodeFactory codeFactory, IDisassemblerFactory disassemblerFactory, IInstructionWithAddressOperandDecider jumpTargetAddressDecider) { m_functionParser = functionParser ?? throw new ArgumentNullException(nameof(functionParser)); m_codeFactory = codeFactory ?? throw new ArgumentNullException(nameof(codeFactory)); m_disassemblerFactory = disassemblerFactory ?? throw new ArgumentNullException(nameof(disassemblerFactory)); m_jumpTargetAddressDecider = jumpTargetAddressDecider ?? throw new ArgumentNullException(nameof(jumpTargetAddressDecider)); }
public TransformationAddingJunkBytes(IInstructionWithAddressOperandDecider instructionWithAddressOperandDecider, IInstructionWithAddressOperandTransform instructionWithAddressOperandTransform, ICodeInMemoryLayoutFactory codeInMemoryLayoutFactory, ICodeFactory codeFactory, IInstructionWithAddressOperandTransform jumpInstrucionTransform, ICodeTransform codeTransform, IStatistics statistics, IRelocationDirectoryFromNewCode relocationDirectoryFromNewCode, IJunkBytesProvider junkBytesProvider, IDisassemblerFactory disassemblerFactory) : base(instructionWithAddressOperandDecider, instructionWithAddressOperandTransform, codeFactory, codeInMemoryLayoutFactory, codeTransform, statistics, relocationDirectoryFromNewCode) { m_junkBytesProvider = junkBytesProvider ?? throw new ArgumentNullException(nameof(junkBytesProvider)); m_disassemblerFactory = disassemblerFactory ?? throw new ArgumentNullException(nameof(disassemblerFactory)); }
/// <summary> /// Find the first instrucion index that is not affected by the junk insertion in the new block. /// In other words: it Finds the first instruction in the new block which is identical to instruction /// in the original basic block. the identical instruction start an identical sequence of instructions /// untill the end of the two blocks. /// </summary> /// <param name="newBasicBlockBytes">new basic block bytes</param> /// <param name="basicBlock">original basic block</param> /// <param name="disassemblerFactory">diassembler factory</param> /// <returns>the first index of unaffected instruction in the original basic block, or not o value otherwise</returns> private uint?CompareDisassembleToOriginal(byte[] newBasicBlockBytes, IBasicBlock basicBlock, IDisassemblerFactory disassemblerFactory) { //disassemble new bytes after junk have been inserted var newAssemblyInstructions = new List <IAssemblyInstructionForTransformation>(); IDisassembler disasm = disassemblerFactory.Create(newBasicBlockBytes); foreach (var instruction in disasm.Disassemble()) { newAssemblyInstructions.Add(instruction); } //not enought instruction have been decoded right in this block! if (newAssemblyInstructions.Count <= 1) { return(null); } //compare to original basic block instructions //start from index 1 because first instruction is the inserted junk... for (int i = 1; i < newAssemblyInstructions.Count(); i++) { for (int j = 0; j < basicBlock.AssemblyInstructions.Count; j++) { //compare instruction until the end if they are equal if (newAssemblyInstructions[i].BytesEquals(basicBlock.AssemblyInstructions[j])) { if (instructionAreIdenticalUntilTheEnd(newAssemblyInstructions, i + 1, basicBlock.AssemblyInstructions, j + 1)) { return((uint?)j); } } } } return(null); }