/// <summary> /// Get an Instruction's Details. /// </summary> /// <param name="hInstruction"> /// An instruction handle. /// </param> /// <returns> /// The instruction's details. A null reference indicates the instruction was disassembled without /// details. /// </returns> internal static NativeInstructionDetail?GetInstructionDetail(NativeInstructionHandle hInstruction) { var pInstruction = hInstruction.DangerousAddRefAndGetHandle(); try { // ... // // First, we calculate the memory address of the <c>NativeInstruction.Details</c> field, which is // always relative to the memory address of its defining <c>NativeInstruction</c> structure. This is // NOT the actual memory address of the instruction's details. var instructionDetailOffset = Marshal.OffsetOf(typeof(NativeInstruction), nameof(NativeInstruction.Details)); var pInstructionDetail = (IntPtr)((long)pInstruction + (long)instructionDetailOffset); // ... // // Second, we read the value of the <c>NativeInstruction.Details</c> field, which IS the actual memory // address of the instruction's details. If the value is not equal to <c>IntPtr.Zero</c>, that indicates // the instruction was disassembled with details. var ppInstructionDetail = Marshal.ReadIntPtr(pInstructionDetail); NativeInstructionDetail?instructionDetail = null; if (ppInstructionDetail != IntPtr.Zero) { instructionDetail = MarshalExtension.PtrToStructure <NativeInstructionDetail>(ppInstructionDetail); } return(instructionDetail); } finally { hInstruction.DangerousRelease(); } }
/// <summary> /// Marshal a Pointer to a Collection of Structures. /// </summary> /// <typeparam name="T"> /// The collection's type. /// </typeparam> /// <param name="p"> /// A pointer to a collection. The pointer should be initialized to the collection's starting address. /// </param> /// <param name="size"> /// The collection's size. /// </param> /// <returns> /// The destination collection. /// </returns> internal static T[] PtrToStructure <T>(IntPtr p, int size) { var array = new T[size]; var index = p; for (var i = 0; i < size; i++) { var element = MarshalExtension.PtrToStructure <T>(index); array[i] = element; index += Marshal.SizeOf(typeof(T)); } return(array); }
/// <summary> /// Get an Instruction's Architecture Specific Details. /// </summary> /// <typeparam name="TInstructionDetails"> /// The type of the instruction's architecture specific details. /// </typeparam> /// <param name="instruction"> /// An instruction. /// </param> /// <returns> /// The instruction's architecture specific details. A null reference indicates the instruction was /// disassembled without its details. /// </returns> internal static TInstructionDetails?GetInstructionDetail <TInstructionDetails>(ref NativeInstruction instruction) where TInstructionDetails : struct { TInstructionDetails?instructionDetails = null; if (instruction.Details != IntPtr.Zero) { // ... // // Throws an exception if the operation fails. var pInstructionDetails = instruction.Details + NativeCapstone.MagicInstructionArchitectureDetailsFieldOffset; instructionDetails = MarshalExtension.PtrToStructure <TInstructionDetails>(pInstructionDetails); } return(instructionDetails); }
/// <summary> /// Get an Instruction's Details. /// </summary> /// <param name="instruction"> /// An instruction. /// </param> /// <returns> /// The instruction's details. A null reference indicates the instruction was disassembled without /// details. /// </returns> internal static NativeInstructionDetail?GetInstructionDetail(ref NativeInstruction instruction) { NativeInstructionDetail?instructionDetails = null; if (instruction.Details != IntPtr.Zero) { // ... // // Throws an exception if the operation fails. var pInstructionDetails = instruction.Details; instructionDetails = MarshalExtension.PtrToStructure <NativeInstructionDetail>(pInstructionDetails); } return(instructionDetails); }
/// <summary> /// Get an Instruction. /// </summary> /// <param name="hInstruction"> /// An instruction handle. /// </param> /// <returns> /// An instruction. /// </returns> internal static NativeInstruction GetInstruction(NativeInstructionHandle hInstruction) { var pInstruction = hInstruction.DangerousAddRefAndGetHandle(); try { // ... // // Throws an exception if the operation fails. var instruction = MarshalExtension.PtrToStructure <NativeInstruction>(pInstruction); return(instruction); } finally { hInstruction.DangerousRelease(); } }