示例#1
0
        /// <summary>
        ///     Get an Instruction's Details.
        /// </summary>
        /// <param name="hInstruction">
        ///     An instruction handle.
        /// </param>
        /// <returns>
        ///     The instruction's details. A null reference indicates the instruction was disassembled without
        ///     details.
        /// </returns>
        internal static NativeInstructionDetail?GetInstructionDetail(NativeInstructionHandle hInstruction)
        {
            var pInstruction = hInstruction.DangerousAddRefAndGetHandle();

            try {
                // ...
                //
                // First, we calculate the memory address of the <c>NativeInstruction.Details</c> field, which is
                // always relative to the memory address of its defining <c>NativeInstruction</c> structure. This is
                // NOT the actual memory address of the instruction's details.
                var instructionDetailOffset = Marshal.OffsetOf(typeof(NativeInstruction), nameof(NativeInstruction.Details));
                var pInstructionDetail      = (IntPtr)((long)pInstruction + (long)instructionDetailOffset);

                // ...
                //
                // Second, we read the value of the <c>NativeInstruction.Details</c> field, which IS the actual memory
                // address of the instruction's details. If the value is not equal to <c>IntPtr.Zero</c>, that indicates
                // the instruction was disassembled with details.
                var ppInstructionDetail = Marshal.ReadIntPtr(pInstructionDetail);
                NativeInstructionDetail?instructionDetail = null;
                if (ppInstructionDetail != IntPtr.Zero)
                {
                    instructionDetail = MarshalExtension.PtrToStructure <NativeInstructionDetail>(ppInstructionDetail);
                }

                return(instructionDetail);
            }
            finally {
                hInstruction.DangerousRelease();
            }
        }
示例#2
0
        /// <summary>
        ///     Marshal a Pointer to a Collection of Structures.
        /// </summary>
        /// <typeparam name="T">
        ///     The collection's type.
        /// </typeparam>
        /// <param name="p">
        ///     A pointer to a collection. The pointer should be initialized to the collection's starting address.
        /// </param>
        /// <param name="size">
        ///     The collection's size.
        /// </param>
        /// <returns>
        ///     The destination collection.
        /// </returns>
        internal static T[] PtrToStructure <T>(IntPtr p, int size)
        {
            var array = new T[size];
            var index = p;

            for (var i = 0; i < size; i++)
            {
                var element = MarshalExtension.PtrToStructure <T>(index);
                array[i] = element;

                index += Marshal.SizeOf(typeof(T));
            }

            return(array);
        }
示例#3
0
        /// <summary>
        ///     Get an Instruction's Architecture Specific Details.
        /// </summary>
        /// <typeparam name="TInstructionDetails">
        ///     The type of the instruction's architecture specific details.
        /// </typeparam>
        /// <param name="instruction">
        ///     An instruction.
        /// </param>
        /// <returns>
        ///     The instruction's architecture specific details. A null reference indicates the instruction was
        ///     disassembled without its details.
        /// </returns>
        internal static TInstructionDetails?GetInstructionDetail <TInstructionDetails>(ref NativeInstruction instruction) where TInstructionDetails : struct
        {
            TInstructionDetails?instructionDetails = null;

            if (instruction.Details != IntPtr.Zero)
            {
                // ...
                //
                // Throws an exception if the operation fails.
                var pInstructionDetails = instruction.Details + NativeCapstone.MagicInstructionArchitectureDetailsFieldOffset;
                instructionDetails = MarshalExtension.PtrToStructure <TInstructionDetails>(pInstructionDetails);
            }

            return(instructionDetails);
        }
示例#4
0
        /// <summary>
        ///     Get an Instruction's Details.
        /// </summary>
        /// <param name="instruction">
        ///     An instruction.
        /// </param>
        /// <returns>
        ///     The instruction's details. A null reference indicates the instruction was disassembled without
        ///     details.
        /// </returns>
        internal static NativeInstructionDetail?GetInstructionDetail(ref NativeInstruction instruction)
        {
            NativeInstructionDetail?instructionDetails = null;

            if (instruction.Details != IntPtr.Zero)
            {
                // ...
                //
                // Throws an exception if the operation fails.
                var pInstructionDetails = instruction.Details;
                instructionDetails = MarshalExtension.PtrToStructure <NativeInstructionDetail>(pInstructionDetails);
            }

            return(instructionDetails);
        }
示例#5
0
        /// <summary>
        ///     Get an Instruction.
        /// </summary>
        /// <param name="hInstruction">
        ///     An instruction handle.
        /// </param>
        /// <returns>
        ///     An instruction.
        /// </returns>
        internal static NativeInstruction GetInstruction(NativeInstructionHandle hInstruction)
        {
            var pInstruction = hInstruction.DangerousAddRefAndGetHandle();

            try {
                // ...
                //
                // Throws an exception if the operation fails.
                var instruction = MarshalExtension.PtrToStructure <NativeInstruction>(pInstruction);
                return(instruction);
            }
            finally {
                hInstruction.DangerousRelease();
            }
        }