public static bool DecomposeTest3() { byte[] testCode = { 0x8B, 0x89, 0xC8, 0x02, 0x00, 0x00, 0x8B, 0x51, 0x64, 0xF3, 0x0F, 0x10, 0x4A, 0x64, 0x0F, 0x2F, 0xC8, 0x8B, 0x86, 0x44, 0x04, 0x00, 0x00, 0xF3, 0x0F, 0x10, 0x88, 0x34, 0x02, 0x00, 0x00, 0xF3, 0x0F, 0x5C, 0xC1, 0xF3, 0x0F, 0x11, 0x44, 0x24, 0x18, 0x8B, 0x56, 0x60, 0x8B, 0x46, 0x64 }; string expectedOutput = "mov ecx, [ecx+0x2c8]" + "mov edx, [ecx+0x64]" + "movss xmm1, [edx+0x64]" + "comiss xmm1, xmm0" + "mov eax, [esi+0x444]" + "movss xmm1, [eax+0x234]" + "subss xmm0, xmm1" + "movss [esp+0x18], xmm0" + "mov edx, [esi+0x60]" + "mov eax, [esi+0x64]"; Distorm.DInst[] insts = Distorm.Decompose(testCode, 0, Distorm.DecodeType.Decode32Bits); string actualOutput = string.Join(string.Empty, insts.Select(x => x.ToString())); return(expectedOutput.Equals(actualOutput)); }
public bool Disassemble(Distorm.DecodeType decodeType) { if (this.Data.Length == 0) { return(false); } if (this.InstructionsDisassembled.Count != 0) { this.InstructionsDisassembled = Distorm.Disassemble(this.Data, (ulong)Address.ToInt64(), decodeType); if (this.InstructionsDisassembled.Count == 0) { return(false); } } if (this.InstructionsDecomposed.Length != 0) { this.InstructionsDecomposed = Distorm.Decompose(this.Data, (ulong)Address.ToInt64(), decodeType); if (this.InstructionsDecomposed.Length == 0) { return(false); } } return(true); }
public static bool TestInput(byte[] input, string expectedOutput) { Distorm.DInst[] insts = Distorm.Decompose(input); if (insts.Length != 1) { return(false); } return(insts[0].ToString().Equals(expectedOutput)); }
/// <summary> /// Tests the DistormSimple.Decompose() function, but with an incomplete code buffer. This assumes that the /// DistormSimple.Decompose() function works properly with a properly made code buffer. /// </summary> /// <returns>Returns true if the test passed.</returns> public static bool DecomposeWrapperIncompleteCodeTest() { byte[] incompleteCode = new byte[Program.code.Length]; Array.Copy(code, incompleteCode, incompleteCode.Length - 1); // Set the last byte to the first part of a "mov ebp, esp" instruction. incompleteCode[incompleteCode.Length - 1] = 0x8b; Distorm.DInst[] insts = Distorm.Decompose(incompleteCode); if (insts.Length < 6) { return(false); } else if (insts[5].InstructionType != Distorm.InstructionType.UNDEFINED) { return(false); } return(true); }
/// <summary> /// Tests the DistormSimple.Decompose() function. /// </summary> /// <returns>Returns true if the test passed.</returns> public static bool DecomposeWrapperTest() { Distorm.DInst[] result = Distorm.Decompose(Program.code); return(Program.VerifyDecomposition(result)); }