// Instruction callback Pin calls this function every time a new instruction is encountered
// (Testing if better than trace iteration)
void Instruction(INS ins,void *v){

	//printf("ADDR %08x - INS %s\n" , INS_Address(ins), INS_Disassemble(ins).c_str());
	/*
	MemoryRange mem;
	
	ProcInfo::getInstance()->getMemoryRange(0x75e714a4 ,mem);

	if(mem.StartAddress <= 0x75e714a4  &&  0x75e714a4  <= mem.EndAddress){
		MYINFO("yyyyyyyyyyyyyyyyyNow the address has been mapped EIP:%08x  mapped from %08x -> %08x name %s",INS_Address(ins),mem.StartAddress,mem.EndAddress,RTN_FindNameByAddress(INS_Address(ins)).c_str());
	}
	else{ 
		MYINFO("zzzzzzCur EIP:%08x name %s ",INS_Address(ins),RTN_FindNameByAddress(INS_Address(ins)).c_str());
	}
	*/

	Config *config = Config::getInstance();
	if(config->ANTIEVASION_MODE){
		thider.avoidEvasion(ins);
	}
	
	if(config->UNPACKING_MODE){
		oepf.IsCurrentInOEP(ins);
	}	
	

}
Ejemplo n.º 2
0
// Pin calls this function every time a new instruction is encountered
void Trace(TRACE trace , void *v)
{
	for(BBL bbl= TRACE_BblHead(trace); BBL_Valid(bbl); bbl = BBL_Next(bbl)){
		for( INS ins = BBL_InsHead(bbl); INS_Valid(ins) ; ins =INS_Next(ins)){
			oepf.IsCurrentInOEP(ins);
		}
	}
}
// Instruction callback Pin calls this function every time a new instruction is encountered
// (Testing if batter than trace iteration)
void Instruction(INS ins,void *v){
	oepf.IsCurrentInOEP(ins);
}