Пример #1
0
        public void UpdateDisassembly(ulong address, byte[] memory, bool showBytes = true)
        {
            this.DisassemblyAddress.Text = "0x" + address.ToString("X");

            string[] disassembly = Zydis_NET.GetInstructions(address, memory, showBytes);

            ShowBytesCheckBox.Checked = showBytes;

            DisassemblyRichTextBot.Clear();
            for (int i = 0; i < disassembly.Length; i++)
            {
                DisassemblyRichTextBot.AppendText(disassembly[i] + "\n");
            }

            DisassemblyRichTextBot.SelectAll();
            DisassemblyRichTextBot.SelectionColor = Color.Black;

            int firstCharIndex  = DisassemblyRichTextBot.GetFirstCharIndexFromLine(0);
            int nextLineIndex   = DisassemblyRichTextBot.GetFirstCharIndexFromLine(1);
            int selectionLength = nextLineIndex - firstCharIndex;

            DisassemblyRichTextBot.Select(firstCharIndex, selectionLength);
            DisassemblyRichTextBot.SelectionColor  = Color.Blue;
            DisassemblyRichTextBot.SelectionLength = 0;
        }
Пример #2
0
        public static string[] GetInstructions(ulong startAddress, byte[] buffer, bool showBytes = true)
        {
            ulong count = Zydis_NET.GetInstructionCount(startAddress, buffer, buffer.Length);

            byte[] instructionBytes = new byte[count * 128];
            Zydis_NET.GetInstructionStringArray(startAddress, buffer, buffer.Length, instructionBytes);

            string[] instructions = new string[count];

            for (ulong i = 0; i < count; i++)
            {
                ulong  address   = BitConverter.ToUInt64(instructionBytes, ((int)i * 128) + 0);
                ulong  bytecount = BitConverter.ToUInt64(instructionBytes, ((int)i * 128) + 0x8);
                string bytes     = BitConverter.ToString(instructionBytes, ((int)i * 128) + 0x10, (int)bytecount);
                string line      = Encoding.UTF8.GetString(instructionBytes, ((int)i * 128) + 0x20, 96);

                if (line.IndexOf('\0') != 0)
                {
                    line = line.Substring(0, line.IndexOf('\0'));
                }

                if (showBytes)
                {
                    instructions[i] = String.Format("0x{0} {1,-35} {2}", address.ToString("X"), bytes, CleanInstruction(line));
                }
                else
                {
                    instructions[i] = String.Format("0x{0} \t {1}", address.ToString("X"), CleanInstruction(line));
                }
            }

            return(instructions);
        }