x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 5 Activity

DBG: added Capstone::IsLoop and fixed Capstone::IsFilling

This commit is contained in:
Mr. eXoDia 2015-07-07 15:13:29 +02:00
parent 0c8b6c8df7
commit 53fd990c83
6 changed files with 29 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
x64_dbg_dbg/_global.h
View File

@ -17,6 +17,7 @@
#include <vector>
#include <stack>
#include <map>
#include <set>
#include <algorithm>
#include <unordered_map>
#include <tlhelp32.h>

25
x64_dbg_dbg/capstone_wrapper.cpp
View File

@ -86,7 +86,7 @@ String Capstone::OperandText(int opindex)
case X86_OP_IMM:
{
if(InGroup(CS_GRP_JUMP) || InGroup(CS_GRP_CALL))
if(InGroup(CS_GRP_JUMP) || InGroup(CS_GRP_CALL) || IsLoop())
sprintf_s(temp, "%"fext"X", op.imm + mInstr->size);
else
sprintf_s(temp, "%"fext"X", op.imm);
@ -163,8 +163,27 @@ const cs_x86 & Capstone::x86()
bool Capstone::IsFilling()
{
uint8_t opcode = x86().opcode[0];
return opcode == 0x90 || opcode == 0xCC;
switch(GetId())
{
case X86_INS_NOP:
case X86_INS_INT3:
return true;
default:
return false;
}
}
bool Capstone::IsLoop()
{
switch(GetId())
{
case X86_INS_LOOP:
case X86_INS_LOOPE:
case X86_INS_LOOPNE:
return true;
default:
return false;
}
}
x86_insn Capstone::GetId()

1
x64_dbg_dbg/capstone_wrapper.h
View File

@ -24,6 +24,7 @@ public:
const uint Address();
const cs_x86 & x86();
bool IsFilling();
bool IsLoop();
x86_insn GetId();
String InstructionText();

2
x64_dbg_dbg/disasm_fast.cpp
View File

@ -38,7 +38,7 @@ void fillbasicinfo(Capstone* cp, BASIC_INSTRUCTION_INFO* basicinfo)
basicinfo->branch = true;
basicinfo->call = true;
}
else if(cp->InGroup(CS_GRP_JUMP))
else if(cp->InGroup(CS_GRP_JUMP) || cp->IsLoop())
{
basicinfo->branch = true;
}

2
x64_dbg_dbg/disasm_helper.cpp
View File

@ -204,7 +204,7 @@ void disasmget(unsigned char* buffer, uint addr, DISASM_INSTR* instr)
sprintf_s(instr->instruction, "%s %s", cp.GetInstr()->mnemonic, cp.GetInstr()->op_str);
const cs_x86 & x86 = cp.GetInstr()->detail->x86;
instr->instr_size = cp.GetInstr()->size;
if(cp.InGroup(CS_GRP_JUMP) || cp.InGroup(CS_GRP_RET) || cp.InGroup(CS_GRP_CALL))
if(cp.InGroup(CS_GRP_JUMP) || cp.IsLoop() || cp.InGroup(CS_GRP_RET) || cp.InGroup(CS_GRP_CALL))
instr->type = instr_branch;
else if(strstr(cp.GetInstr()->op_str, "sp") || strstr(cp.GetInstr()->op_str, "bp"))
instr->type = instr_stack;

6
x64_dbg_dbg/functionanalysis.cpp
View File

@ -112,7 +112,7 @@ uint FunctionAnalysis::FindFunctionEnd(uint start, uint maxaddr)
break;
const cs_x86_op & operand = _cp.x86().operands[0];
if(_cp.InGroup(CS_GRP_JUMP) && operand.type == X86_OP_IMM) //jump
if((_cp.InGroup(CS_GRP_JUMP) || _cp.IsLoop()) && operand.type == X86_OP_IMM) //jump
{
uint dest = (uint)operand.imm;
@ -124,7 +124,7 @@ uint FunctionAnalysis::FindFunctionEnd(uint start, uint maxaddr)
{
fardest = dest;
}
else if(end && dest < end && _cp.GetId() == X86_INS_JMP) //save the last JMP backwards
else if(end && dest < end && (_cp.GetId() == X86_INS_JMP || _cp.GetId() == X86_INS_LOOP)) //save the last JMP backwards
{
jumpback = addr;
}
@ -149,7 +149,7 @@ uint FunctionAnalysis::GetReferenceOperand()
for(int i = 0; i < _cp.x86().op_count; i++)
{
const cs_x86_op & operand = _cp.x86().operands[i];
if(_cp.InGroup(CS_GRP_JUMP)) //skip jumps
if(_cp.InGroup(CS_GRP_JUMP) || _cp.IsLoop()) //skip jumps/loops
continue;
if(operand.type == X86_OP_IMM) //we are looking for immediate references
{