Пример #1
0
        /// <summary>
        /// Disassembles the given code
        /// </summary>
        /// <param name="generatedCode">The generated code</param>
        public string Disassemble(IList <byte> generatedCode)
        {
            var output = new StringBuilder();
            var buffer = new UnmanagedBuffer(generatedCode.ToArray());

            var disasm = new Disasm()
            {
                Archi = 64
            };

            int offset = 0;

            while (offset < generatedCode.Count)
            {
                disasm.EIP = new IntPtr(buffer.Ptr.ToInt64() + offset);
                int result = BeaEngine64.Disasm(disasm);

                if (result == (int)BeaConstants.SpecialInfo.UNKNOWN_OPCODE)
                {
                    break;
                }

                //strBuffer.AppendLine("0x" + offset.ToString("X") + " " + disasm.CompleteInstr);
                output.AppendLine(disasm.CompleteInstr);
                offset += result;
            }

            return(output.ToString());
        }
Пример #2
0
        /// <summary>
        /// Disassembles the code block starting at the given index
        /// </summary>
        /// <param name="index">The start of the block</param>
        /// <param name="size">The size of the block</param>
        /// <param name="addLine">Adds output</param>
        public void DisassembleBlock(int index, int size, Action <string> addLine)
        {
            int offset = index;

            while (offset < index + size)
            {
                this.disassembler.EIP = new IntPtr(this.codeBuffer.Ptr.ToInt64() + offset);
                int result = BeaEngine64.Disasm(this.disassembler);

                if (result == (int)BeaConstants.SpecialInfo.UNKNOWN_OPCODE)
                {
                    break;
                }

                addLine(this.disassembler.CompleteInstr);
                //output.AppendLine("0x" + this.disassembler.EIP.ToString("X") + " " + this.disassembler.CompleteInstr);
                offset += result;
            }
        }