x64dbg
/
TitanEngine
mirror of https://github.com/x64dbg/TitanEngine
1
0
Fork 0
Code Releases Activity

- updated codeblocks project 

- update scylla_wrapper_x64
- AStyle formatting
- TCHAR->WCHAR (somehow didn't compile here), also explicit lstrcatW/lstrcpyW
This commit is contained in:
mr.exodia 2014-01-16 21:16:03 +01:00
parent b29e53cd16
commit 4bda97ecba
6 changed files with 208 additions and 187 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
TitanEngine/TitanEngine.cbp
View File

@ -22,6 +22,7 @@
</Compiler> </Compiler>
<Linker> <Linker>
<Add option="/DEF:TitanEngine.def" /> <Add option="/DEF:TitanEngine.def" />
<Add library=".\scylla_wrapper_x86.lib" />
<Add library=".\distorm_x86.lib" /> <Add library=".\distorm_x86.lib" />
<Add library="Imagehlp.lib" /> <Add library="Imagehlp.lib" />
<Add library="psapi.lib" /> <Add library="psapi.lib" />
@ -42,6 +43,7 @@
<Add option="/DUNPACKERENGINE_EXPORTS" /> <Add option="/DUNPACKERENGINE_EXPORTS" />
</Compiler> </Compiler>
<Linker> <Linker>
<Add library=".\scylla_wrapper_x64.lib" />
<Add library=".\distorm_x64.lib" /> <Add library=".\distorm_x64.lib" />
<Add library="Imagehlp.lib" /> <Add library="Imagehlp.lib" />
<Add library="psapi.lib" /> <Add library="psapi.lib" />
@ -54,11 +56,11 @@
<Add library="comdlg32" /> <Add library="comdlg32" />
<Add library="shell32" /> <Add library="shell32" />
</Linker> </Linker>
<Unit filename="3rdparty-definitions.h" />
<Unit filename="LzmaDec.cpp" /> <Unit filename="LzmaDec.cpp" />
<Unit filename="LzmaDec.h" /> <Unit filename="LzmaDec.h" />
<Unit filename="LzmaTypes.h" /> <Unit filename="LzmaTypes.h" />
<Unit filename="TitanEngine.cpp" /> <Unit filename="TitanEngine.cpp" />
<Unit filename="TitanEngine.h" />
<Unit filename="TitanEngine.rc"> <Unit filename="TitanEngine.rc">
<Option compilerVar="WINDRES" /> <Option compilerVar="WINDRES" />
</Unit> </Unit>

72
TitanEngine/TitanEngine.cpp
View File

@ -18579,11 +18579,11 @@ __declspec(dllexport) void TITCALL ImporterAddNewDll(char* szDLLName, ULONG_PTR
RtlMoveMemory((LPVOID)(impDLLDataList[impDLLNumber][1]), &FirstThunk, sizeof ULONG_PTR); RtlMoveMemory((LPVOID)(impDLLDataList[impDLLNumber][1]), &FirstThunk, sizeof ULONG_PTR);
RtlMoveMemory((LPVOID)(impDLLDataList[impDLLNumber][1] + sizeof ULONG_PTR), &FirstThunk, sizeof ULONG_PTR); RtlMoveMemory((LPVOID)(impDLLDataList[impDLLNumber][1] + sizeof ULONG_PTR), &FirstThunk, sizeof ULONG_PTR);
RtlMoveMemory((LPVOID)(impDLLDataList[impDLLNumber][1] + 2 * sizeof ULONG_PTR), &CopyDummy, 4); RtlMoveMemory((LPVOID)(impDLLDataList[impDLLNumber][1] + 2 * sizeof ULONG_PTR), &CopyDummy, 4);
#if !defined(_WIN64) #if !defined(_WIN64)
impDLLDataList[impDLLNumber][1] = impDLLDataList[impDLLNumber][0] + 12; impDLLDataList[impDLLNumber][1] = impDLLDataList[impDLLNumber][0] + 12;
#else #else
impDLLDataList[impDLLNumber][1] = impDLLDataList[impDLLNumber][0] + 20; impDLLDataList[impDLLNumber][1] = impDLLDataList[impDLLNumber][0] + 20;
#endif #endif
RtlMoveMemory((LPVOID)(impDLLStringList[impDLLNumber][1]), szDLLName, lstrlenA((LPCSTR)szDLLName)); RtlMoveMemory((LPVOID)(impDLLStringList[impDLLNumber][1]), szDLLName, lstrlenA((LPCSTR)szDLLName));
impDLLStringList[impDLLNumber][1] = impDLLStringList[impDLLNumber][1] + lstrlenA((LPCSTR)szDLLName) + 3; impDLLStringList[impDLLNumber][1] = impDLLStringList[impDLLNumber][1] + lstrlenA((LPCSTR)szDLLName) + 3;
if(FirstThunk == NULL && impDeltaStart != NULL) if(FirstThunk == NULL && impDeltaStart != NULL)
@ -18723,7 +18723,8 @@ __declspec(dllexport) void TITCALL ImporterMoveIAT()
} }
__declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap) __declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap)
{ {
if(scylla_fixMappedDump(StorePlace, FileMapVA, hFileMap) != SCY_ERROR_SUCCESS) { if(scylla_fixMappedDump(StorePlace, FileMapVA, hFileMap) != SCY_ERROR_SUCCESS)
{
return false; return false;
} }
@ -18781,7 +18782,8 @@ __declspec(dllexport) bool TITCALL ImporterExportIATEx(char* szDumpFileName, cha
} }
__declspec(dllexport) bool TITCALL ImporterExportIATExW(wchar_t* szDumpFileName, wchar_t* szExportFileName, wchar_t* szSectionName) __declspec(dllexport) bool TITCALL ImporterExportIATExW(wchar_t* szDumpFileName, wchar_t* szExportFileName, wchar_t* szSectionName)
{ {
if(scylla_fixDump(szDumpFileName, szExportFileName, szSectionName) != SCY_ERROR_SUCCESS) { if(scylla_fixDump(szDumpFileName, szExportFileName, szSectionName) != SCY_ERROR_SUCCESS)
{
return false; return false;
} }
@ -18807,11 +18809,11 @@ __declspec(dllexport) long long TITCALL ImporterFindAPIWriteLocation(char* szAPI
DLLNumber = impDLLNumber + 1; DLLNumber = impDLLNumber + 1;
while(DLLNumber > NULL) while(DLLNumber > NULL)
{ {
#if !defined(_WIN64) #if !defined(_WIN64)
NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 12); NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 12);
#else #else
NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 20); NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 20);
#endif #endif
RtlMoveMemory(&CurrentAPILocation, (LPVOID)(impDLLDataList[i][0]), sizeof ULONG_PTR); RtlMoveMemory(&CurrentAPILocation, (LPVOID)(impDLLDataList[i][0]), sizeof ULONG_PTR);
RtlMoveMemory(&NumberOfAPIs, (LPVOID)(impDLLDataList[i][0] + 2 * sizeof ULONG_PTR), 4); RtlMoveMemory(&NumberOfAPIs, (LPVOID)(impDLLDataList[i][0] + 2 * sizeof ULONG_PTR), 4);
while(NumberOfAPIs > NULL) while(NumberOfAPIs > NULL)
@ -18866,11 +18868,11 @@ __declspec(dllexport) long long TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR
DLLNumber = impDLLNumber + 1; DLLNumber = impDLLNumber + 1;
while(DLLNumber > NULL) while(DLLNumber > NULL)
{ {
#if !defined(_WIN64) #if !defined(_WIN64)
NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 12); NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 12);
#else #else
NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 20); NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 20);
#endif #endif
RtlMoveMemory(&MinAPILocation, (LPVOID)(impDLLDataList[i][0]), sizeof ULONG_PTR); RtlMoveMemory(&MinAPILocation, (LPVOID)(impDLLDataList[i][0]), sizeof ULONG_PTR);
RtlMoveMemory(&MaxAPILocation, (LPVOID)(impDLLDataList[i][0] + sizeof ULONG_PTR), sizeof ULONG_PTR); RtlMoveMemory(&MaxAPILocation, (LPVOID)(impDLLDataList[i][0] + sizeof ULONG_PTR), sizeof ULONG_PTR);
if(MinAPILocation <= APIWriteLocation && APIWriteLocation <= MaxAPILocation) if(MinAPILocation <= APIWriteLocation && APIWriteLocation <= MaxAPILocation)
@ -18901,11 +18903,11 @@ __declspec(dllexport) long long TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR
DLLNumber = impDLLNumber + 1; DLLNumber = impDLLNumber + 1;
while(DLLNumber > NULL) while(DLLNumber > NULL)
{ {
#if !defined(_WIN64) #if !defined(_WIN64)
NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 12); NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 12);
#else #else
NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 20); NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 20);
#endif #endif
RtlMoveMemory(&MinAPILocation, (LPVOID)(impDLLDataList[i][0]), sizeof ULONG_PTR); RtlMoveMemory(&MinAPILocation, (LPVOID)(impDLLDataList[i][0]), sizeof ULONG_PTR);
RtlMoveMemory(&MaxAPILocation, (LPVOID)(impDLLDataList[i][0] + sizeof ULONG_PTR), sizeof ULONG_PTR); RtlMoveMemory(&MaxAPILocation, (LPVOID)(impDLLDataList[i][0] + sizeof ULONG_PTR), sizeof ULONG_PTR);
if(MinAPILocation <= APIWriteLocation && APIWriteLocation <= MaxAPILocation) if(MinAPILocation <= APIWriteLocation && APIWriteLocation <= MaxAPILocation)
@ -19459,7 +19461,8 @@ __declspec(dllexport) void TITCALL ImporterAutoSearchIATW(DWORD ProcessId, wchar
scylla_searchIAT(ProcessId, iatStart, iatSize, SearchStart, false); scylla_searchIAT(ProcessId, iatStart, iatSize, SearchStart, false);
//we also try to automatically read imports so following call to ExportIAT has a chance //we also try to automatically read imports so following call to ExportIAT has a chance
if(iatStart != NULL && iatSize != NULL) { if(iatStart != NULL && iatSize != NULL)
{
scylla_getImports(iatStart, iatSize, ProcessId); scylla_getImports(iatStart, iatSize, ProcessId);
} }
@ -19512,11 +19515,11 @@ __declspec(dllexport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack)
DLLNumber = impDLLNumber + 1; DLLNumber = impDLLNumber + 1;
while(DLLNumber > NULL) while(DLLNumber > NULL)
{ {
#if !defined(_WIN64) #if !defined(_WIN64)
NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 12); NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 12);
#else #else
NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 20); NameReadPlace = (LPVOID)(impDLLDataList[i][0] + 20);
#endif #endif
RtlMoveMemory(&CurrentAPILocation, (LPVOID)(impDLLDataList[i][0]), sizeof ULONG_PTR); RtlMoveMemory(&CurrentAPILocation, (LPVOID)(impDLLDataList[i][0]), sizeof ULONG_PTR);
RtlMoveMemory(&NumberOfAPIs, (LPVOID)(impDLLDataList[i][0] + 2 * sizeof ULONG_PTR), 4); RtlMoveMemory(&NumberOfAPIs, (LPVOID)(impDLLDataList[i][0] + 2 * sizeof ULONG_PTR), 4);
RtlZeroMemory(&myImportEnumData, sizeof ImportEnumData); RtlZeroMemory(&myImportEnumData, sizeof ImportEnumData);
@ -19596,19 +19599,19 @@ __declspec(dllexport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, wchar_
ULONG_PTR FileMapVA; ULONG_PTR FileMapVA;
ULONG_PTR iatStart = NULL; ULONG_PTR iatStart = NULL;
DWORD iatSize = NULL; DWORD iatSize = NULL;
TCHAR IatFixFileName[MAX_PATH]; WCHAR IatFixFileName[MAX_PATH];
TCHAR DumpFileName[MAX_PATH]; WCHAR DumpFileName[MAX_PATH];
lstrcpy(DumpFileName, szDumpedFile); lstrcpyW(DumpFileName, szDumpedFile);
TCHAR* Extension = wcsrchr(DumpFileName, L'.'); WCHAR* Extension = wcsrchr(DumpFileName, L'.');
TCHAR Bak = *Extension; WCHAR Bak = *Extension;
*Extension = 0; *Extension = 0;
lstrcpy(IatFixFileName, DumpFileName); lstrcpyW(IatFixFileName, DumpFileName);
*Extension = Bak; *Extension = Bak;
lstrcat(IatFixFileName, L"_scy"); lstrcatW(IatFixFileName, L"_scy");
lstrcat(IatFixFileName, Extension); lstrcatW(IatFixFileName, Extension);
lstrcat(DumpFileName, Extension); lstrcatW(DumpFileName, Extension);
//do we need to dump first? //do we need to dump first?
if(DumpRunningProcess) if(DumpRunningProcess)
@ -19624,24 +19627,29 @@ __declspec(dllexport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, wchar_
//we need to fix iat, thats for sure //we need to fix iat, thats for sure
int ret = scylla_searchIAT(ProcessId, iatStart, iatSize, SearchStart, false); int ret = scylla_searchIAT(ProcessId, iatStart, iatSize, SearchStart, false);
if(ret != SCY_ERROR_SUCCESS) { if(ret != SCY_ERROR_SUCCESS)
if(ret == SCY_ERROR_PROCOPEN) { {
if(ret == SCY_ERROR_PROCOPEN)
{
return (0x401); //error proc terminated return (0x401); //error proc terminated
} }
if(ret == SCY_ERROR_IATNOTFOUND || ret == SCY_ERROR_IATSEARCH) { if(ret == SCY_ERROR_IATNOTFOUND || ret == SCY_ERROR_IATSEARCH)
{
return (0x405); //no API found return (0x405); //no API found
} }
} }
scylla_getImports(iatStart, iatSize, ProcessId, UnknownPointerFixCallback); scylla_getImports(iatStart, iatSize, ProcessId, UnknownPointerFixCallback);
if(!scylla_importsValid()) { if(!scylla_importsValid())
{
return (0x405); return (0x405);
} }
ret = scylla_fixDump(szDumpedFile, IatFixFileName, szSectionName); ret = scylla_fixDump(szDumpedFile, IatFixFileName, szSectionName);
if(ret == SCY_ERROR_IATWRITE) { if(ret == SCY_ERROR_IATWRITE)
{
return (0x407); return (0x407);
} }

261
TitanEngine/distorm.h
View File

@ -36,26 +36,26 @@ along with this program. If not, see <http://www.gnu.org/licenses/>
*/ */
#if !(defined(DISTORM_STATIC) || defined(DISTORM_DYNAMIC)) #if !(defined(DISTORM_STATIC) || defined(DISTORM_DYNAMIC))
/* Define this macro for outer projects by default. */ /* Define this macro for outer projects by default. */
#define SUPPORT_64BIT_OFFSET #define SUPPORT_64BIT_OFFSET
#endif #endif
/* TINYC has a problem with some 64bits library functions, so ignore 64 bit offsets. */ /* TINYC has a problem with some 64bits library functions, so ignore 64 bit offsets. */
#ifdef __TINYC__ #ifdef __TINYC__
#undef SUPPORT_64BIT_OFFSET #undef SUPPORT_64BIT_OFFSET
#endif #endif
/* If your compiler doesn't support stdint.h, define your own 64 bits type. */ /* If your compiler doesn't support stdint.h, define your own 64 bits type. */
#ifdef SUPPORT_64BIT_OFFSET #ifdef SUPPORT_64BIT_OFFSET
#ifdef _MSC_VER #ifdef _MSC_VER
#define OFFSET_INTEGER unsigned __int64 #define OFFSET_INTEGER unsigned __int64
#else
#include <stdint.h>
#define OFFSET_INTEGER uint64_t
#endif
#else #else
/* 32 bit offsets are used. */ #include <stdint.h>
#define OFFSET_INTEGER unsigned long #define OFFSET_INTEGER uint64_t
#endif
#else
/* 32 bit offsets are used. */
#define OFFSET_INTEGER unsigned long
#endif #endif
#ifdef _MSC_VER #ifdef _MSC_VER
@ -72,7 +72,7 @@ typedef unsigned __int8 uint8_t;
/* Support C++ compilers */ /* Support C++ compilers */
#ifdef __cplusplus #ifdef __cplusplus
extern "C" { extern "C" {
#endif #endif
@ -115,82 +115,90 @@ typedef unsigned __int8 uint8_t;
/* Decodes modes of the disassembler, 16 bits or 32 bits or 64 bits for AMD64, x86-64. */ /* Decodes modes of the disassembler, 16 bits or 32 bits or 64 bits for AMD64, x86-64. */
typedef enum { Decode16Bits = 0, Decode32Bits = 1, Decode64Bits = 2 } _DecodeType; typedef enum {
Decode16Bits = 0, Decode32Bits = 1, Decode64Bits = 2
}
_DecodeType;
typedef OFFSET_INTEGER _OffsetType; typedef OFFSET_INTEGER _OffsetType;
typedef struct { typedef struct
_OffsetType codeOffset, nextOffset; /* nextOffset is OUT only. */ {
const uint8_t* code; _OffsetType codeOffset, nextOffset; /* nextOffset is OUT only. */
int codeLen; /* Using signed integer makes it easier to detect an underflow. */ const uint8_t* code;
_DecodeType dt; int codeLen; /* Using signed integer makes it easier to detect an underflow. */
unsigned int features; _DecodeType dt;
unsigned int features;
} _CodeInfo; } _CodeInfo;
typedef enum { O_NONE, O_REG, O_IMM, O_IMM1, O_IMM2, O_DISP, O_SMEM, O_MEM, O_PC, O_PTR } _OperandType; typedef enum { O_NONE, O_REG, O_IMM, O_IMM1, O_IMM2, O_DISP, O_SMEM, O_MEM, O_PC, O_PTR } _OperandType;
typedef union { typedef union
/* Used by O_IMM: */ {
int8_t sbyte; /* Used by O_IMM: */
uint8_t byte; int8_t sbyte;
int16_t sword; uint8_t byte;
uint16_t word; int16_t sword;
int32_t sdword; uint16_t word;
uint32_t dword; int32_t sdword;
int64_t sqword; /* All immediates are SIGN-EXTENDED to 64 bits! */ uint32_t dword;
uint64_t qword; int64_t sqword; /* All immediates are SIGN-EXTENDED to 64 bits! */
uint64_t qword;
/* Used by O_PC: (Use GET_TARGET_ADDR).*/ /* Used by O_PC: (Use GET_TARGET_ADDR).*/
_OffsetType addr; /* It's a relative offset as for now. */ _OffsetType addr; /* It's a relative offset as for now. */
/* Used by O_PTR: */ /* Used by O_PTR: */
struct { struct
uint16_t seg; {
/* Can be 16 or 32 bits, size is in ops[n].size. */ uint16_t seg;
uint32_t off; /* Can be 16 or 32 bits, size is in ops[n].size. */
} ptr; uint32_t off;
} ptr;
/* Used by O_IMM1 (i1) and O_IMM2 (i2). ENTER instruction only. */ /* Used by O_IMM1 (i1) and O_IMM2 (i2). ENTER instruction only. */
struct { struct
uint32_t i1; {
uint32_t i2; uint32_t i1;
} ex; uint32_t i2;
} ex;
} _Value; } _Value;
typedef struct { typedef struct
/* Type of operand: {
O_NONE: operand is to be ignored. /* Type of operand:
O_REG: index holds global register index. O_NONE: operand is to be ignored.
O_IMM: instruction.imm. O_REG: index holds global register index.
O_IMM1: instruction.imm.ex.i1. O_IMM: instruction.imm.
O_IMM2: instruction.imm.ex.i2. O_IMM1: instruction.imm.ex.i1.
O_DISP: memory dereference with displacement only, instruction.disp. O_IMM2: instruction.imm.ex.i2.
O_SMEM: simple memory dereference with optional displacement (a single register memory dereference). O_DISP: memory dereference with displacement only, instruction.disp.
O_MEM: complex memory dereference (optional fields: s/i/b/disp). O_SMEM: simple memory dereference with optional displacement (a single register memory dereference).
O_PC: the relative address of a branch instruction (instruction.imm.addr). O_MEM: complex memory dereference (optional fields: s/i/b/disp).
O_PTR: the absolute target address of a far branch instruction (instruction.imm.ptr.seg/off). O_PC: the relative address of a branch instruction (instruction.imm.addr).
*/ O_PTR: the absolute target address of a far branch instruction (instruction.imm.ptr.seg/off).
uint8_t type; /* _OperandType */ */
uint8_t type; /* _OperandType */
/* Index of: /* Index of:
O_REG: holds global register index O_REG: holds global register index
O_SMEM: holds the 'base' register. E.G: [ECX], [EBX+0x1234] are both in operand.index. O_SMEM: holds the 'base' register. E.G: [ECX], [EBX+0x1234] are both in operand.index.
O_MEM: holds the 'index' register. E.G: [EAX*4] is in operand.index. O_MEM: holds the 'index' register. E.G: [EAX*4] is in operand.index.
*/ */
uint8_t index; uint8_t index;
/* Size of: /* Size of:
O_REG: register O_REG: register
O_IMM: instruction.imm O_IMM: instruction.imm
O_IMM1: instruction.imm.ex.i1 O_IMM1: instruction.imm.ex.i1
O_IMM2: instruction.imm.ex.i2 O_IMM2: instruction.imm.ex.i2
O_DISP: instruction.disp O_DISP: instruction.disp
O_SMEM: size of indirection. O_SMEM: size of indirection.
O_MEM: size of indirection. O_MEM: size of indirection.
O_PC: size of the relative offset O_PC: size of the relative offset
O_PTR: size of instruction.imm.ptr.off (16 or 32) O_PTR: size of instruction.imm.ptr.off (16 or 32)
*/ */
uint16_t size; uint16_t size;
} _Operand; } _Operand;
#define OPCODE_ID_NONE 0 #define OPCODE_ID_NONE 0
@ -231,43 +239,45 @@ typedef struct {
#define OPERANDS_NO (4) #define OPERANDS_NO (4)
typedef struct { typedef struct
/* Used by ops[n].type == O_IMM/O_IMM1&O_IMM2/O_PTR/O_PC. Its size is ops[n].size. */ {
_Value imm; /* Used by ops[n].type == O_IMM/O_IMM1&O_IMM2/O_PTR/O_PC. Its size is ops[n].size. */
/* Used by ops[n].type == O_SMEM/O_MEM/O_DISP. Its size is dispSize. */ _Value imm;
uint64_t disp; /* Used by ops[n].type == O_SMEM/O_MEM/O_DISP. Its size is dispSize. */
/* Virtual address of first byte of instruction. */ uint64_t disp;
_OffsetType addr; /* Virtual address of first byte of instruction. */
/* General flags of instruction, holds prefixes and more, if FLAG_NOT_DECODABLE, instruction is invalid. */ _OffsetType addr;
uint16_t flags; /* General flags of instruction, holds prefixes and more, if FLAG_NOT_DECODABLE, instruction is invalid. */
/* Unused prefixes mask, for each bit that is set that prefix is not used (LSB is byte [addr + 0]). */ uint16_t flags;
uint16_t unusedPrefixesMask; /* Unused prefixes mask, for each bit that is set that prefix is not used (LSB is byte [addr + 0]). */
/* Mask of registers that were used in the operands, only used for quick look up, in order to know *some* operand uses that register class. */ uint16_t unusedPrefixesMask;
uint16_t usedRegistersMask; /* Mask of registers that were used in the operands, only used for quick look up, in order to know *some* operand uses that register class. */
/* ID of opcode in the global opcode table. Use for mnemonic look up. */ uint16_t usedRegistersMask;
uint16_t opcode; /* ID of opcode in the global opcode table. Use for mnemonic look up. */
/* Up to four operands per instruction, ignored if ops[n].type == O_NONE. */ uint16_t opcode;
_Operand ops[OPERANDS_NO]; /* Up to four operands per instruction, ignored if ops[n].type == O_NONE. */
/* Size of the whole instruction. */ _Operand ops[OPERANDS_NO];
uint8_t size; /* Size of the whole instruction. */
/* Segment information of memory indirection, default segment, or overriden one, can be -1. Use SEGMENT macros. */ uint8_t size;
uint8_t segment; /* Segment information of memory indirection, default segment, or overriden one, can be -1. Use SEGMENT macros. */
/* Used by ops[n].type == O_MEM. Base global register index (might be R_NONE), scale size (2/4/8), ignored for 0 or 1. */ uint8_t segment;
uint8_t base, scale; /* Used by ops[n].type == O_MEM. Base global register index (might be R_NONE), scale size (2/4/8), ignored for 0 or 1. */
uint8_t dispSize; uint8_t base, scale;
/* Meta defines the instruction set class, and the flow control flags. Use META macros. */ uint8_t dispSize;
uint8_t meta; /* Meta defines the instruction set class, and the flow control flags. Use META macros. */
/* The CPU flags that the instruction operates upon. */ uint8_t meta;
uint8_t modifiedFlagsMask, testedFlagsMask, undefinedFlagsMask; /* The CPU flags that the instruction operates upon. */
uint8_t modifiedFlagsMask, testedFlagsMask, undefinedFlagsMask;
} _DInst; } _DInst;
#ifndef DISTORM_LIGHT #ifndef DISTORM_LIGHT
/* Static size of strings. Do not change this value. Keep Python wrapper in sync. */ /* Static size of strings. Do not change this value. Keep Python wrapper in sync. */
#define MAX_TEXT_SIZE (48) #define MAX_TEXT_SIZE (48)
typedef struct { typedef struct
unsigned int length; {
unsigned char p[MAX_TEXT_SIZE]; /* p is a null terminated string. */ unsigned int length;
unsigned char p[MAX_TEXT_SIZE]; /* p is a null terminated string. */
} _WString; } _WString;
/* /*
@ -275,12 +285,13 @@ typedef struct {
* Used only for backward compatibility with diStorm64. * Used only for backward compatibility with diStorm64.
* This structure holds all information the disassembler generates per instruction. * This structure holds all information the disassembler generates per instruction.
*/ */
typedef struct { typedef struct
_WString mnemonic; /* Mnemonic of decoded instruction, prefixed if required by REP, LOCK etc. */ {
_WString operands; /* Operands of the decoded instruction, up to 3 operands, comma-seperated. */ _WString mnemonic; /* Mnemonic of decoded instruction, prefixed if required by REP, LOCK etc. */
_WString instructionHex; /* Hex dump - little endian, including prefixes. */ _WString operands; /* Operands of the decoded instruction, up to 3 operands, comma-seperated. */
unsigned int size; /* Size of decoded instruction. */ _WString instructionHex; /* Hex dump - little endian, including prefixes. */
_OffsetType offset; /* Start offset of the decoded instruction. */ unsigned int size; /* Size of decoded instruction. */
_OffsetType offset; /* Start offset of the decoded instruction. */
} _DecodedInst; } _DecodedInst;
#endif /* DISTORM_LIGHT */ #endif /* DISTORM_LIGHT */
@ -429,28 +440,28 @@ typedef enum { DECRES_NONE, DECRES_SUCCESS, DECRES_MEMORYERR, DECRES_INPUTERR, D
*/ */
#ifdef SUPPORT_64BIT_OFFSET #ifdef SUPPORT_64BIT_OFFSET
_DecodeResult distorm_decompose64(_CodeInfo* ci, _DInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount); _DecodeResult distorm_decompose64(_CodeInfo* ci, _DInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount);
#define distorm_decompose distorm_decompose64 #define distorm_decompose distorm_decompose64
#ifndef DISTORM_LIGHT #ifndef DISTORM_LIGHT
/* If distorm-light is defined, we won't export these text-formatting functionality. */ /* If distorm-light is defined, we won't export these text-formatting functionality. */
_DecodeResult distorm_decode64(_OffsetType codeOffset, const unsigned char* code, int codeLen, _DecodeType dt, _DecodedInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount); _DecodeResult distorm_decode64(_OffsetType codeOffset, const unsigned char* code, int codeLen, _DecodeType dt, _DecodedInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount);
void distorm_format64(const _CodeInfo* ci, const _DInst* di, _DecodedInst* result); void distorm_format64(const _CodeInfo* ci, const _DInst* di, _DecodedInst* result);
#define distorm_decode distorm_decode64 #define distorm_decode distorm_decode64
#define distorm_format distorm_format64 #define distorm_format distorm_format64
#endif /*DISTORM_LIGHT*/ #endif /*DISTORM_LIGHT*/
#else /*SUPPORT_64BIT_OFFSET*/ #else /*SUPPORT_64BIT_OFFSET*/
_DecodeResult distorm_decompose32(_CodeInfo* ci, _DInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount); _DecodeResult distorm_decompose32(_CodeInfo* ci, _DInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount);
#define distorm_decompose distorm_decompose32 #define distorm_decompose distorm_decompose32
#ifndef DISTORM_LIGHT #ifndef DISTORM_LIGHT
/* If distorm-light is defined, we won't export these text-formatting functionality. */ /* If distorm-light is defined, we won't export these text-formatting functionality. */
_DecodeResult distorm_decode32(_OffsetType codeOffset, const unsigned char* code, int codeLen, _DecodeType dt, _DecodedInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount); _DecodeResult distorm_decode32(_OffsetType codeOffset, const unsigned char* code, int codeLen, _DecodeType dt, _DecodedInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount);
void distorm_format32(const _CodeInfo* ci, const _DInst* di, _DecodedInst* result); void distorm_format32(const _CodeInfo* ci, const _DInst* di, _DecodedInst* result);
#define distorm_decode distorm_decode32 #define distorm_decode distorm_decode32
#define distorm_format distorm_format32 #define distorm_format distorm_format32
#endif /*DISTORM_LIGHT*/ #endif /*DISTORM_LIGHT*/
#endif #endif

BIN
TitanEngine/scylla_wrapper_x64.lib
View File

Binary file not shown.

BIN
TitanEngine/scylla_wrapperd_x64.lib
View File

Binary file not shown.