rallhook 0.7.5 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
data/AUTHORS CHANGED
@@ -1,3 +1,5 @@
1
1
  rallhook de tario <rseminara@hotmail.com>
2
2
 
3
+ Thanks to:
3
4
 
5
+ Gil Dabah for provide distorm, the Ultimate Dissasembler Library (https://code.google.com/p/distorm/)
data/CHANGELOG CHANGED
@@ -1,3 +1,5 @@
1
+ 0.8.0 Added code of diStorm library to make easier the gem install (no previous install of diStorm are required now)
2
+
1
3
  0.7.5 Fixed issue 13 (Segmentation fault in ruby 1.9)
2
4
 
3
5
  0.7.4 Fixed issue 12 (Compile error for ruby 1.9)
data/README CHANGED
@@ -10,8 +10,6 @@ This package contains rallhook, a ruby C extension to intercept ruby methods cal
10
10
  * ruby debug info ( apt-get install libruby1.8-dbg or libruby1.9-dbg on debian based systems)
11
11
  * ruby development package ( apt-get install ruby1.8-dev or ruby1.9-dev on debian based systems)
12
12
  * objdump
13
- * distorm ( found at https://code.google.com/p/distorm/ )
14
-
15
13
 
16
14
  === Installation
17
15
 
data/Rakefile CHANGED
@@ -6,7 +6,7 @@ require 'rake/gempackagetask'
6
6
 
7
7
  spec = Gem::Specification.new do |s|
8
8
  s.name = 'rallhook'
9
- s.version = '0.7.5'
9
+ s.version = '0.8.0'
10
10
  s.author = 'Dario Seminara'
11
11
  s.email = 'robertodarioseminara@gmail.com'
12
12
  s.platform = Gem::Platform::RUBY
data/TODO CHANGED
@@ -1,4 +1,3 @@
1
- * Threading support
2
1
  * Tests cases for 1.0.0 interface
3
2
  * More integrity testcases (with use of ruby core methods)
4
3
  * Security testcases (hook bypass checks, security tests)
@@ -0,0 +1,170 @@
1
+ /*
2
+ config.h
3
+
4
+ diStorm3 - Powerful disassembler for X86/AMD64
5
+ http://ragestorm.net/distorm/
6
+ distorm at gmail dot com
7
+ Copyright (C) 2010 Gil Dabah
8
+
9
+ This program is free software: you can redistribute it and/or modify
10
+ it under the terms of the GNU General Public License as published by
11
+ the Free Software Foundation, either version 3 of the License, or
12
+ (at your option) any later version.
13
+
14
+ This program is distributed in the hope that it will be useful,
15
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
16
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17
+ GNU General Public License for more details.
18
+
19
+ You should have received a copy of the GNU General Public License
20
+ along with this program. If not, see <http://www.gnu.org/licenses/>
21
+ */
22
+
23
+
24
+ #ifndef CONFIG_H
25
+ #define CONFIG_H
26
+
27
+ /* diStorm version number. */
28
+ #define __DISTORMV__ 0x030000
29
+
30
+ #include <string.h> /* strlen, memset, memcpy - can be easily self implemented for libc independency. */
31
+
32
+ #include "distorm.h"
33
+
34
+ /*
35
+ * 64 bit offsets support:
36
+ * This macro should be defined from compiler command line flags, e.g: -DSUPPORT_64BIT_OFFSET
37
+ * Note: make sure that the caller (library user) defines it too!
38
+ */
39
+ /* #define SUPPORT_64BIT_OFFSET */
40
+
41
+ /*
42
+ * If you compile diStorm as a .DLL file, make sure you uncomment the next line.
43
+ * So the interface functions will be exported, otherwise they are useable only as a library.
44
+ * For example, this macro is being set for the Python extension module.
45
+ */
46
+ /* #define _DLL */
47
+
48
+ /*
49
+ * diStorm now supports little/big endian CPU's.
50
+ * It should detect the endianness according to predefined macro's of the compiler.
51
+ * If you don't use GCC/MSVC you will have to define it on your own.
52
+ */
53
+
54
+ /* These macros are used in order to make the code portable. */
55
+ #ifdef __GNUC__
56
+
57
+ #include <stdint.h>
58
+
59
+ #define _DLLEXPORT_
60
+ #define _FASTCALL_
61
+ #define _INLINE_ static
62
+ /* GCC ignores this directive... */
63
+ //#define _FASTCALL_ __attribute__((__fastcall__))
64
+
65
+ /* Set endianity (supposed to be LE though): */
66
+ #ifdef __BIG_ENDIAN__
67
+ #define BE_SYSTEM
68
+ #endif
69
+
70
+ /* End of __GCC__ */
71
+
72
+ #elif __WATCOMC__
73
+
74
+ #include <stdint.h>
75
+
76
+ #define _DLLEXPORT_
77
+ #define _FASTCALL_
78
+ #define _INLINE_ __inline
79
+
80
+ /* End of __WATCOMC__ */
81
+
82
+ #elif __DMC__
83
+
84
+ #include <stdint.h>
85
+
86
+ #define _DLLEXPORT_
87
+ #define _FASTCALL_
88
+ #define _INLINE_ __inline
89
+
90
+ /* End of __DMC__ */
91
+
92
+ #elif __TINYC__
93
+
94
+ #include <stdint.h>
95
+
96
+ #define _DLLEXPORT_
97
+ #define _FASTCALL_
98
+ #define _INLINE_
99
+
100
+ /* End of __TINYC__ */
101
+
102
+ #elif _MSC_VER
103
+
104
+ /* stdint alternative is defined in distorm.h */
105
+
106
+ #define _DLLEXPORT_ __declspec(dllexport)
107
+ #define _FASTCALL_ __fastcall
108
+ #define _INLINE_ __inline
109
+
110
+ /* Set endianity (supposed to be LE though): */
111
+ #ifndef _M_IX86
112
+ #define BE_SYSTEM
113
+ #endif
114
+
115
+ #endif /* #elif _MSC_VER */
116
+
117
+ /* If the library isn't compiled as a .DLL don't export functions. */
118
+ #ifndef _DLL
119
+ #undef _DLLEXPORT_
120
+ #define _DLLEXPORT_
121
+ #endif
122
+
123
+ #ifndef FALSE
124
+ #define FALSE 0
125
+ #endif
126
+ #ifndef TRUE
127
+ #define TRUE 1
128
+ #endif
129
+
130
+ /* Define stream read functions for big endian systems. */
131
+ #ifdef BE_SYSTEM
132
+ /*
133
+ * These functions can read from the stream safely!
134
+ * Swap endianity of input to little endian.
135
+ */
136
+ static _INLINE_ int16_t RSHORT(const uint8_t *s)
137
+ {
138
+ return s[0] | (s[1] << 8);
139
+ }
140
+ static _INLINE_ uint16_t RUSHORT(const uint8_t *s)
141
+ {
142
+ return s[0] | (s[1] << 8);
143
+ }
144
+ static _INLINE_ int32_t RLONG(const uint8_t *s)
145
+ {
146
+ return s[0] | (s[1] << 8) | (s[2] << 16) | (s[3] << 24);
147
+ }
148
+ static _INLINE_ uint32_t RULONG(const uint8_t *s)
149
+ {
150
+ return s[0] | (s[1] << 8) | (s[2] << 16) | (s[3] << 24);
151
+ }
152
+ static _INLINE_ int64_t RLLONG(const uint8_t *s)
153
+ {
154
+ return s[0] | (s[1] << 8) | (s[2] << 16) | (s[3] << 24) | ((uint64_t)s[4] << 32) | ((uint64_t)s[5] << 40) | ((uint64_t)s[6] << 48) | ((uint64_t)s[7] << 56);
155
+ }
156
+ static _INLINE_ uint64_t RULLONG(const uint8_t *s)
157
+ {
158
+ return s[0] | (s[1] << 8) | (s[2] << 16) | (s[3] << 24) | ((uint64_t)s[4] << 32) | ((uint64_t)s[5] << 40) | ((uint64_t)s[6] << 48) | ((uint64_t)s[7] << 56);
159
+ }
160
+ #else
161
+ /* Little endian macro's will just make the cast. */
162
+ #define RSHORT(x) *(int16_t *)x
163
+ #define RUSHORT(x) *(uint16_t *)x
164
+ #define RLONG(x) *(int32_t *)x
165
+ #define RULONG(x) *(uint32_t *)x
166
+ #define RLLONG(x) *(int64_t *)x
167
+ #define RULLONG(x) *(uint64_t *)x
168
+ #endif
169
+
170
+ #endif /* CONFIG_H */
@@ -0,0 +1,401 @@
1
+ /* diStorm3 1.0.0 */
2
+
3
+ /*
4
+ distorm.h
5
+
6
+ diStorm3 - Powerful disassembler for X86/AMD64
7
+ http://ragestorm.net/distorm/
8
+ distorm at gmail dot com
9
+ Copyright (C) 2010 Gil Dabah
10
+
11
+ This program is free software: you can redistribute it and/or modify
12
+ it under the terms of the GNU General Public License as published by
13
+ the Free Software Foundation, either version 3 of the License, or
14
+ (at your option) any later version.
15
+
16
+ This program is distributed in the hope that it will be useful,
17
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
18
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19
+ GNU General Public License for more details.
20
+
21
+ You should have received a copy of the GNU General Public License
22
+ along with this program. If not, see <http://www.gnu.org/licenses/>
23
+ */
24
+
25
+
26
+ #ifndef DISTORM_H
27
+ #define DISTORM_H
28
+
29
+ /*
30
+ * 64 bit offsets support:
31
+ * If the diStorm library you use was compiled with 64 bits offsets,
32
+ * make sure you compile your own code with the following macro set:
33
+ * SUPPORT_64BIT_OFFSET
34
+ * Otherwise comment it out, or you will get a linker error of an unresolved symbol...
35
+ */
36
+
37
+ /* TINYC has a problem with some 64bits library functions, so pass. */
38
+ #ifndef __TINYC__
39
+ #ifndef _LIB /* Used only for library. */
40
+ /* Comment out the following line to disable 64 bits support */
41
+ #define SUPPORT_64BIT_OFFSET
42
+ #endif
43
+ #endif
44
+
45
+ /* If your compiler doesn't support stdint.h, define your own 64 bits type. */
46
+ #ifdef SUPPORT_64BIT_OFFSET
47
+ #ifdef _MSC_VER
48
+ #define OFFSET_INTEGER unsigned __int64
49
+ #else
50
+ #include <stdint.h>
51
+ #define OFFSET_INTEGER uint64_t
52
+ #endif
53
+ #else
54
+ /* 32 bit offsets are used. */
55
+ #define OFFSET_INTEGER unsigned long
56
+ #endif
57
+
58
+ #ifdef _MSC_VER
59
+ /* Since MSVC isn't shipped with stdint.h, we will have our own: */
60
+ typedef signed __int64 int64_t;
61
+ typedef unsigned __int64 uint64_t;
62
+ typedef signed __int32 int32_t;
63
+ typedef unsigned __int32 uint32_t;
64
+ typedef signed __int16 int16_t;
65
+ typedef unsigned __int16 uint16_t;
66
+ typedef signed __int8 int8_t;
67
+ typedef unsigned __int8 uint8_t;
68
+ #endif
69
+
70
+ /* Support C++ compilers */
71
+ #ifdef __cplusplus
72
+ extern "C" {
73
+ #endif
74
+
75
+ /* Decodes modes of the disassembler, 16 bits or 32 bits or 64 bits for AMD64, x86-64. */
76
+ typedef enum {Decode16Bits = 0, Decode32Bits = 1, Decode64Bits = 2} _DecodeType;
77
+
78
+ typedef OFFSET_INTEGER _OffsetType;
79
+
80
+ typedef struct {
81
+ _OffsetType codeOffset;
82
+ const uint8_t* code;
83
+ int codeLen; /* Using signed integer makes it easier to detect an underflow. */
84
+ _DecodeType dt;
85
+ unsigned int features;
86
+ } _CodeInfo;
87
+
88
+ typedef enum { O_NONE, O_REG, O_IMM, O_IMM1, O_IMM2, O_DISP, O_SMEM, O_MEM, O_PC, O_PTR } _OperandType;
89
+
90
+ typedef union {
91
+ /* Used by O_IMM: */
92
+ int8_t sbyte;
93
+ uint8_t byte;
94
+ int16_t sword;
95
+ uint16_t word;
96
+ int32_t sdword;
97
+ uint32_t dword;
98
+ int64_t sqword;
99
+ uint64_t qword;
100
+
101
+ /* Used by O_PC: */
102
+ _OffsetType addr;
103
+
104
+ /* Used by O_PTR: */
105
+ struct {
106
+ uint16_t seg;
107
+ /* Can be 16 or 32 bits, size is in ops[n].size. */
108
+ uint32_t off;
109
+ } ptr;
110
+ /* Used by O_IMM1 (i1) and O_IMM2 (i2). */
111
+ struct {
112
+ uint32_t i1;
113
+ uint32_t i2;
114
+ } ex;
115
+ } _Value;
116
+
117
+ typedef struct {
118
+ /* Type of operand:
119
+ O_NONE: operand is to be ignored.
120
+ O_REG: index holds global register index.
121
+ O_IMM: instruction.imm.
122
+ O_IMM1: instruction.imm.ex.i1.
123
+ O_IMM2: instruction.imm.ex.i2.
124
+ O_DISP: memory dereference with displacement only, instruction.disp.
125
+ O_SMEM: simple memory dereference with optional displacement (a single register memory dereference).
126
+ O_MEM: complex memory dereference (optional fields: s/i/b/disp).
127
+ O_PC: the relative address of a branch instruction (instruction.imm.addr).
128
+ O_PTR: the absolute target address of a far branch instruction (instruction.imm.ptr.seg/off).
129
+ */
130
+ uint8_t type; /* _OperandType */
131
+
132
+ /* Index of:
133
+ O_REG: holds global register index
134
+ O_SMEM: holds the 'base' register. E.G: [ECX], [EBX+0x1234] are both in operand.index.
135
+ O_MEM: holds the 'index' register. E.G: [EAX*4] is in operand.index.
136
+ */
137
+ uint8_t index;
138
+
139
+ /* Size of:
140
+ O_REG: register
141
+ O_IMM: instruction.imm
142
+ O_IMM1: instruction.imm.ex.i1
143
+ O_IMM2: instruction.imm.ex.i2
144
+ O_DISP: instruction.disp
145
+ O_SMEM: size of indirection.
146
+ O_MEM: size of indirection.
147
+ O_PC: size of the relative offset
148
+ O_PTR: size of instruction.imm.ptr.off (16 or 32)
149
+ */
150
+ uint16_t size;
151
+ } _Operand;
152
+
153
+ #define OPCODE_ID_NONE 0
154
+ /* Instruction could not be disassembled. */
155
+ #define FLAG_NOT_DECODABLE ((uint16_t)-1)
156
+ /* The instruction locks memory access. */
157
+ #define FLAG_LOCK (1 << 0)
158
+ /* The instruction is prefixed with a REPNZ. */
159
+ #define FLAG_REPNZ (1 << 1)
160
+ /* The instruction is prefixed with a REP, this can be a REPZ, it depends on the specific instruction. */
161
+ #define FLAG_REP (1 << 2)
162
+ /* Indicates there is a hint taken for Jcc instructions only. */
163
+ #define FLAG_HINT_TAKEN (1 << 3)
164
+ /* Indicates there is a hint non-taken for Jcc instructions only. */
165
+ #define FLAG_HINT_NOT_TAKEN (1 << 4)
166
+ /* The Imm value is signed extended. */
167
+ #define FLAG_IMM_SIGNED (1 << 5)
168
+
169
+ /* No register was defined. */
170
+ #define R_NONE ((uint8_t)-1)
171
+
172
+ #define REGS64_BASE (0)
173
+ #define REGS32_BASE (16)
174
+ #define REGS16_BASE (32)
175
+ #define REGS8_BASE (48)
176
+ #define REGS8_REX_BASE (64)
177
+ #define SREGS_BASE (68)
178
+ /* #define RIP 74 */
179
+ #define FPUREGS_BASE (75)
180
+ #define MMXREGS_BASE (83)
181
+ #define SSEREGS_BASE (91)
182
+ #define AVXREGS_BASE (107)
183
+ #define CREGS_BASE (123)
184
+ #define DREGS_BASE (132)
185
+
186
+ /*
187
+ * Operand Size or Adderss size are stored inside the flags:
188
+ * 0 - 16 bits
189
+ * 1 - 32 bits
190
+ * 2 - 64 bits
191
+ * 3 - reserved
192
+ *
193
+ * If you call these macros more than once, you will have to clean the bits before doing so.
194
+ */
195
+ #define FLAG_SET_OPSIZE(di, size) ((di->flags) |= (((size) & 3) << 6))
196
+ #define FLAG_SET_ADDRSIZE(di, size) ((di->flags) |= (((size) & 3) << 8))
197
+ #define FLAG_GET_OPSIZE(flags) (((flags) >> 6) & 3)
198
+ #define FLAG_GET_ADDRSIZE(flags) (((flags) >> 8) & 3)
199
+ /* To get the LOCK/REPNZ/REP prefixes. */
200
+ #define FLAG_GET_PREFIX(flags) ((flags) & 7)
201
+
202
+ /*
203
+ * Macros to extract segment registers from segmentInfo:
204
+ */
205
+ #define SEGMENT_DEFAULT 0x80
206
+ #define SEGMENT_SET(di, seg) ((di->segment) |= seg)
207
+ #define SEGMENT_GET(segment) (((segment) == R_NONE) ? R_NONE : ((segment) & 0x7f))
208
+ #define SEGMENT_IS_DEFAULT(segment) (((segment) & SEGMENT_DEFAULT) == SEGMENT_DEFAULT)
209
+
210
+ #define OPERANDS_NO (4)
211
+
212
+ typedef struct {
213
+ /* Virtual address of first byte of instruction. */
214
+ _OffsetType addr;
215
+ /* Size of the whole instruction. */
216
+ uint8_t size;
217
+ /* General flags of instruction, holds prefixes and more, if FLAG_NOT_DECODABLE, instruction is invalid. */
218
+ uint16_t flags;
219
+ /* Segment information of memory indirection, default segment, or overriden one, can be -1. */
220
+ uint8_t segment;
221
+ /* Used by ops[n].type == O_MEM. Base global register index (might be R_NONE), scale size (2/4/8), ignored for 0 or 1. */
222
+ uint8_t base, scale;
223
+ uint8_t dispSize;
224
+ /* ID of opcode in the global opcode table. Use for mnemonic look up. */
225
+ uint16_t opcode;
226
+ /* Up to four operands per instruction, ignored if ops[n].type == O_NONE. */
227
+ _Operand ops[OPERANDS_NO];
228
+ /* Used by ops[n].type == O_SMEM/O_MEM/O_DISP. Its size is dispSize. */
229
+ uint64_t disp;
230
+ /* Used by ops[n].type == O_IMM/O_IMM1&O_IMM2/O_PTR/O_PC. Its size is ops[n].size. */
231
+ _Value imm;
232
+ /* Unused prefixes mask, for each bit that is set that prefix is not used (LSB is byte [addr + 0]). */
233
+ uint16_t unusedPrefixesMask;
234
+ /* Meta defines the instruction set class, and the flow control flags. Use META macros. */
235
+ uint8_t meta;
236
+ } _DInst;
237
+
238
+ /* Static size of strings. Do not change this value. */
239
+ #define MAX_TEXT_SIZE (32)
240
+ typedef struct {
241
+ unsigned int length;
242
+ unsigned char p[MAX_TEXT_SIZE]; /* p is a null terminated string. */
243
+ } _WString;
244
+
245
+ /*
246
+ * Old decoded instruction structure in text format.
247
+ * Used only for backward compatibility with diStorm64.
248
+ * This structure holds all information the disassembler generates per instruction.
249
+ */
250
+ typedef struct {
251
+ _WString mnemonic; /* Mnemonic of decoded instruction, prefixed if required by REP, LOCK etc. */
252
+ _WString operands; /* Operands of the decoded instruction, up to 3 operands, comma-seperated. */
253
+ _WString instructionHex; /* Hex dump - little endian, including prefixes. */
254
+ unsigned int size; /* Size of decoded instruction. */
255
+ _OffsetType offset; /* Start offset of the decoded instruction. */
256
+ } _DecodedInst;
257
+
258
+ /* Get the ISC of the instruction, used with the definitions below. */
259
+ #define META_GET_ISC(meta) (((meta) >> 3) & 0x1f)
260
+ /* Get the flow control flags of the instruction, see 'features for decompose' below. */
261
+ #define META_GET_FC(meta) ((meta) & 0x7)
262
+
263
+ /*
264
+ * Instructions Set classes:
265
+ * if you want a better understanding of the available classes, look at disOps project, file: x86sets.py.
266
+ */
267
+ /* Indicates the instruction belongs to the General Integer set. */
268
+ #define ISC_INTEGER 1
269
+ /* Indicates the instruction belongs to the 387 FPU set. */
270
+ #define ISC_FPU 2
271
+ /* Indicates the instruction belongs to the P6 set. */
272
+ #define ISC_P6 3
273
+ /* Indicates the instruction belongs to the MMX set. */
274
+ #define ISC_MMX 4
275
+ /* Indicates the instruction belongs to the SSE set. */
276
+ #define ISC_SSE 5
277
+ /* Indicates the instruction belongs to the SSE2 set. */
278
+ #define ISC_SSE2 6
279
+ /* Indicates the instruction belongs to the SSE3 set. */
280
+ #define ISC_SSE3 7
281
+ /* Indicates the instruction belongs to the SSSE3 set. */
282
+ #define ISC_SSSE3 8
283
+ /* Indicates the instruction belongs to the SSE4.1 set. */
284
+ #define ISC_SSE4_1 9
285
+ /* Indicates the instruction belongs to the SSE4.2 set. */
286
+ #define ISC_SSE4_2 10
287
+ /* Indicates the instruction belongs to the AMD's SSE4.A set. */
288
+ #define ISC_SSE4_A 11
289
+ /* Indicates the instruction belongs to the 3DNow! set. */
290
+ #define ISC_3DNOW 12
291
+ /* Indicates the instruction belongs to the 3DNow! Extensions set. */
292
+ #define ISC_3DNOWEXT 13
293
+ /* Indicates the instruction belongs to the VMX (Intel) set. */
294
+ #define ISC_VMX 14
295
+ /* Indicates the instruction belongs to the SVM (AMD) set. */
296
+ #define ISC_SVM 15
297
+ /* Indicates the instruction belongs to the AVX (Intel) set. */
298
+ #define ISC_AVX 16
299
+ /* Indicates the instruction belongs to the FMA (Intel) set. */
300
+ #define ISC_FMA 17
301
+ /* Indicates the instruction belongs to the AES/AVX (Intel) set. */
302
+ #define ISC_AES 18
303
+ /* Indicates the instruction belongs to the CLMUL (Intel) set. */
304
+ #define ISC_CLMUL 19
305
+
306
+ /* Features for decompose: */
307
+ #define DF_NONE 0
308
+ /* The decoder will limit addresses to a maximum of 16 bits. */
309
+ #define DF_MAXIMUM_ADDR16 1
310
+ /* The decoder will limit addresses to a maximum of 32 bits. */
311
+ #define DF_MAXIMUM_ADDR32 2
312
+ /* The decoder will return only flow control instructions (and filter the others internally). */
313
+ #define DF_RETURN_FC_ONLY 4
314
+ /* The decoder will stop and return to the caller when the instruction 'CALL' (near and far) was decoded. */
315
+ #define DF_STOP_ON_CALL 8
316
+ /* The decoder will stop and return to the caller when the instruction 'RET' (near and far) was decoded. */
317
+ #define DF_STOP_ON_RET 0x10
318
+ /* The decoder will stop and return to the caller when the instruction system-call/ret was decoded. */
319
+ #define DF_STOP_ON_SYS 0x20
320
+ /* The decoder will stop and return to the caller when any of the branch 'JMP', (near and far) instructions were decoded. */
321
+ #define DF_STOP_ON_BRANCH 0x40
322
+ /* The decoder will stop and return to the caller when any of the conditional branch instruction were decoded. */
323
+ #define DF_STOP_ON_COND_BRANCH 0x80
324
+ /* The decoder will stop and return to the caller when the instruction 'INT' (INT, INT1, INTO, INT 3) was decoded. */
325
+ #define DF_STOP_ON_INT 0x100
326
+ /* The decoder will stop and return to the caller when any flow control instruction was decoded. */
327
+ #define DF_STOP_ON_FLOW_CONTROL (DF_STOP_ON_CALL | DF_STOP_ON_RET | DF_STOP_ON_SYS | DF_STOP_ON_BRANCH | DF_STOP_ON_COND_BRANCH | DF_STOP_ON_INT)
328
+
329
+ /* Indicates the instruction is not a flow-control instruction. */
330
+ #define FC_NONE 0
331
+ /* Indicates the instruction is one of: CALL, CALL FAR. */
332
+ #define FC_CALL 1
333
+ /* Indicates the instruction is one of: RET, IRET, RETF. */
334
+ #define FC_RET 2
335
+ /* Indicates the instruction is one of: SYSCALL, SYSRET, SYSENTER, SYSEXIT. */
336
+ #define FC_SYS 3
337
+ /* Indicates the instruction is one of: JMP, JMP FAR. */
338
+ #define FC_BRANCH 4
339
+ /*
340
+ * Indicates the instruction is one of:
341
+ * JCXZ, JO, JNO, JB, JAE, JZ, JNZ, JBE, JA, JS, JNS, JP, JNP, JL, JGE, JLE, JG, LOOP, LOOPZ, LOOPNZ.
342
+ */
343
+ #define FC_COND_BRANCH 5
344
+ /* Indiciates the instruction is one of: INT, INT1, INT 3, INTO, UD2. */
345
+ #define FC_INT 6
346
+
347
+ /* Return code of the decoding function. */
348
+ typedef enum {DECRES_NONE, DECRES_SUCCESS, DECRES_MEMORYERR, DECRES_INPUTERR, DECRES_FILTERED} _DecodeResult;
349
+
350
+ #ifndef _LIB /* Don't redefine those exports when compiling the library itself, only for library-user project. */
351
+
352
+ /* distorm_decode
353
+ * Input:
354
+ * offset - Origin of the given code (virtual address that is), NOT an offset in code.
355
+ * code - Pointer to the code buffer to be disassembled.
356
+ * length - Amount of bytes that should be decoded from the code buffer.
357
+ * dt - Decoding mode, 16 bits (Decode16Bits), 32 bits (Decode32Bits) or AMD64 (Decode64Bits).
358
+ * result - Array of type _DecodeInst which will be used by this function in order to return the disassembled instructions.
359
+ * maxInstructions - The maximum number of entries in the result array that you pass to this function, so it won't exceed its bound.
360
+ * usedInstructionsCount - Number of the instruction that successfully were disassembled and written to the result array.
361
+ * Output: usedInstructionsCount will hold the number of entries used in the result array
362
+ * and the result array itself will be filled with the disassembled instructions.
363
+ * Return: DECRES_SUCCESS on success (no more to disassemble), DECRES_INPUTERR on input error (null code buffer, invalid decoding mode, etc...),
364
+ * DECRES_MEMORYERR when there are not enough entries to use in the result array, BUT YOU STILL have to check for usedInstructionsCount!
365
+ * Side-Effects: Even if the return code is DECRES_MEMORYERR, there might STILL be data in the
366
+ * array you passed, this function will try to use as much entries as possible!
367
+ * Notes: 1)The minimal size of maxInstructions is 15.
368
+ * 2)You will have to synchronize the offset,code and length by yourself if you pass code fragments and not a complete code block!
369
+ */
370
+ #ifdef SUPPORT_64BIT_OFFSET
371
+ _DecodeResult distorm_decompose64(const _CodeInfo* ci, _DInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount);
372
+ _DecodeResult distorm_decode64(_OffsetType codeOffset, const unsigned char* code, int codeLen, _DecodeType dt, _DecodedInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount);
373
+ void distorm_format64(const _CodeInfo* ci, const _DInst* di, _DecodedInst* result);
374
+ #define distorm_decompose distorm_decompose64
375
+ #define distorm_decode distorm_decode64
376
+ #define distorm_format distorm_format64
377
+ #else
378
+ _DecodeResult distorm_decompose32(const _CodeInfo* ci, _DInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount);
379
+ _DecodeResult distorm_decode32(_OffsetType codeOffset, const unsigned char* code, int codeLen, _DecodeType dt, _DecodedInst result[], unsigned int maxInstructions, unsigned int* usedInstructionsCount);
380
+ void distorm_format32(const _CodeInfo* ci, const _DInst* di, _DecodedInst* result);
381
+ #define distorm_decompose distorm_decompose32
382
+ #define distorm_decode distorm_decode32
383
+ #define distorm_format distorm_format32
384
+ #endif
385
+
386
+ /*
387
+ * distorm_version
388
+ * Input:
389
+ * none
390
+ *
391
+ * Output: unsigned int - version of compiled library.
392
+ */
393
+ extern unsigned int distorm_version();
394
+
395
+ #endif /* _LIB */
396
+
397
+ #ifdef __cplusplus
398
+ } /* End Of Extern */
399
+ #endif
400
+
401
+ #endif /* DISTORM_H */