Esempio n. 1
0
void check_call(DECAF_Callback_Params *param) {
  uint32_t eip, cr3, insn_buf;
  CPUState *env = NULL;

  //If we've gotten this far, params is not null
  if(calls<MAXCALLS) {
    env = param->be.env;
    if(env!=NULL) {
      eip=DECAF_getPC(env);
      cr3=DECAF_getPGD(env);
    } else {
      eip=0x0;
      cr3=0x0;
    }

    DECAF_printf("sysenter_eip: (0x%x)\n", env->sysenter_eip);
    fprintf(tracefile, "sysenter_eip: (0x%x)\n", env->sysenter_eip);
    fprintf(tracefile, "sysenter_esp: (0x%x)\n", env->sysenter_esp);
    fprintf(tracefile, "current esp: (0x%x)\n", env->regs[R_ESP]-env->sysenter_eip);
    //fprintf(tracefile, "idt base: (0x%x) \n", env->idt.base); 

    //Read 32bits worth of code... will be used to identify this later
    DECAF_read_mem(env,param->be.cur_pc,sizeof(uint32_t),&insn_buf);
    DECAF_printf("call: (0x%x@0x%x) 0x%x\n", eip-env->sysenter_eip, cr3, insn_buf);
    fprintf(tracefile, "call: (0x%x@0x%x) 0x%x\n", eip-env->sysenter_eip, cr3,
            insn_buf);
    fprintf(tracefile, "call (-esp): (0x%x@0x%x) 0x%x\n", eip-env->sysenter_esp, 
            cr3, insn_buf);
    calls++;
  }
}
Esempio n. 2
0
static int instruction_tracer_init(void)
{
  DECAF_printf("initializing instruction tracer...\n");

  processbegin_handle = VMI_register_callback(VMI_CREATEPROC_CB,
      &instruction_tracer_load_main_module_callback, NULL);
  if (processbegin_handle == DECAF_NULL_HANDLE) {
    DECAF_printf("Could not register initial callback\n");
  }

    return 0;
}
Esempio n. 3
0
static void NtCreateFile_ret(void *param)
{
	NtCreateFile_hook_context_t *ctx = (NtCreateFile_hook_context_t *)param;
	DECAF_printf("NtCreateFile exit:");

	hookapi_remove_hook(ctx->hook_handle);
	uint32_t out_handle;

	DECAF_read_mem(NULL, ctx->call_stack[1], 4, &out_handle);
	DECAF_printf("out_handle=%08x\n", out_handle);
	free(ctx);
}
Esempio n. 4
0
static void VirtualAlloc_ret(void *param)
{
	NtCreateFile_hook_context_t *ctx = (NtCreateFile_hook_context_t *)param;
	DECAF_printf("VirtualAlloc exit:");

	hookapi_remove_hook(ctx->hook_handle);
	DECAF_printf("lpAddress=%08x, dwSize=%d, ret=%08x\n", ctx->call_stack[1], 
		ctx->call_stack[2], cpu_single_env->regs[R_EAX]);

	free(ctx);

}
Esempio n. 5
0
plugin_interface_t* init_plugin(void)
{
  DECAF_printf("start init_plugin\n");
  instruction_tracer_interface.mon_cmds = instruction_tracer_term_cmds;
  DECAF_printf("mon_cmds done\n");
  instruction_tracer_interface.plugin_cleanup = &instraction_tracer_cleanup;
  DECAF_printf("plugin_cleanup done\n");

  instruction_tracer_init();
  DECAF_printf("instruction_tracer done\n");
  return (&instruction_tracer_interface);
}
Esempio n. 6
0
static int hookapitests_init(void)
{
	DECAF_output_init(NULL);
	DECAF_printf("Hello World\n");
	//register for process create and process remove events
	processbegin_handle = VMI_register_callback(VMI_CREATEPROC_CB,
			&createproc_callback, NULL);
	removeproc_handle = VMI_register_callback(VMI_REMOVEPROC_CB,
			&removeproc_callback, NULL);
	if ((processbegin_handle == DECAF_NULL_HANDLE)
			|| (removeproc_handle == DECAF_NULL_HANDLE)) {
		DECAF_printf(
				"Could not register for the create or remove proc events\n");
	}
	return (0);
}
Esempio n. 7
0
void do_read_taint_mem(DECAF_Callback_Params *param)
{
	uint32_t eip = cpu_single_env->eip;
	uint32_t cr3 = cpu_single_env->cr[3];
	char name[128];
	dmodule * dm = NULL;
	dm = locate_module(eip,cr3,name);
	if(!dm)
	return;

	if(param->rt.size <=4)
	DECAF_printf("READ 0x%08x 0x%08x 0x%08x %s\n",param->rt.vaddr,param->rt.paddr,*((uint32_t *)param->rt.taint_info),dm->name);
	else
	DECAF_printf("READ 0x%08x 0x%08x 0x%16x %s\n",param->rt.vaddr,param->rt.paddr,*((uint32_t *)param->rt.taint_info),dm->name);

}
Esempio n. 8
0
static void instruction_tracer_process_finished_callback(VMI_Callback_Params* params)
{
  if (target_cr3 == params->rp.cr3) {
    DECAF_printf("target process finished...\n");
    fflush(disas_logfile);  
  }
}
Esempio n. 9
0
/*
 * Since we cannot get process id at translation phase, in order to reduce the performance
 * overhead, we first lookup 'curPC' in the traced process to get in which module the current
 * instruction locates. Then, if the returned module is in 'blacklistLibs', we perform 
 * instrumentation; or if it isn't in 'whitelistLibs', we perform instrumentation too.
 */
int nd_in_blacklist(gva_t addr){
	char moduleName[128];
	moduleName[0] = '\0';
	gva_t startAddr = -1;
	gva_t endAddr = -1;

	//check current pc
	if(addr < 0 || addr >= 0xC0000000){
		return (0);
	}

	//if(ND_GLOBAL_TRACING_PID == getCurrentPID()){ //Note that during translation phase, getCurrentPID() returns 
	//process running rather than process being translated
	getExecutableModuleInfo(ND_GLOBAL_TRACING_PID, moduleName, 128, &startAddr, &endAddr, addr);
	if('\0' != moduleName[0]){
		//in blacklist
		if(StringHashtable_exist(blacklistLibs, moduleName)){
			return (1);
		}

		//not in whitelist
		if(!StringHashtable_exist(whitelistLibs, moduleName)){
			DECAF_printf("Add %s to blacklist\n", moduleName);
			StringHashtable_add(blacklistLibs, moduleName);
			return (1);
		}
	}
	else{
		if(addr != -1 && addr >= GIVEN_LIB_START_ADDR && addr <= GIVEN_LIB_END_ADDR){
			return (1);
		}
	}

	return (0);
}
Esempio n. 10
0
inline void get_symbol(CPUState* env, gpid_t pid, gva_t addr)
{
  char name[128];
  name[0] = '\0';
  getNearestSymbol(name, 128, pid, addr);
  DECAF_printf("%08x is in %s\n", addr, name);
}
Esempio n. 11
0
static void instruction_tracer_cpu_exec_callback(DECAF_Callback_Params* params)
{
  int i;

  if (params->ce.env == NULL) {
    DECAF_printf("NULL\n");
    return;
  }
  if (is_target_program(params->ce.env)) {
    /* if (params->ce.tb_size == 0) { */
    /*   DECAF_printf("\nnull is detected -> eip: 0x%x\n", params->ce.env->eip); */
    /*   fprintf(disas_logfile, "null member is detected\n"); */
    /*   return; */
    /* } */
    if (!params->ce.is_valid) {
      DECAF_printf("not valid\n\n");
      fprintf(disas_logfile, "null member is detected\n\n");
      return;
    }

    target_ulong d_pc = params->ce.tb_pc;
    target_ulong d_size = params->ce.tb_size;

    target_disas(disas_logfile, d_pc, d_size, 0);
    fprintf(disas_logfile, "=\n");

    for (i = 0; i < d_size && i < MAX_CODE_BUF; i++) {
      code_buf[i] = ldub_code(d_pc + i);
      fprintf(disas_logfile, "%02x", code_buf[i]);
    }

    /* if (i => MAX_CODE_BUF) { */
    /*   DECAF_printf("code buffer overflown\n"); */
    /*   code_buf[MAX_CODE_BUF - 1] = '\0'; */
    /* } else { */
    /*   code_buf[i] = '\0'; */
    /* } */

    //fwrite(code_buf, sizeof(unsigned char), i - 1, disas_logfile);

    fprintf(disas_logfile, "\n\n");
  }
}
Esempio n. 12
0
static void instraction_tracer_cleanup(void)
{
  DECAF_printf("cleaning up instruction tracer...\n");
  if (disas_logfile != NULL) {
    fclose(disas_logfile);
  }
  if (processbegin_handle != DECAF_NULL_HANDLE) {
    VMI_unregister_callback(VMI_CREATEPROC_CB, processbegin_handle);
    processbegin_handle = DECAF_NULL_HANDLE;
  }
  if (instruction_tracer_cpu_exec_handle != DECAF_NULL_HANDLE) {
    DECAF_unregister_callback(DECAF_CPU_EXEC_CB, instruction_tracer_cpu_exec_handle);
    instruction_tracer_cpu_exec_handle = DECAF_NULL_HANDLE;
  }
  if (processfinish_handle != DECAF_NULL_HANDLE) {
    VMI_unregister_callback(VMI_REMOVEPROC_CB, processfinish_handle);
    processfinish_handle = DECAF_NULL_HANDLE;
  }
  DECAF_printf("cleaned up\n");
}
Esempio n. 13
0
static int DIT_init(void)
{
  DIT_handle = DS_Dalvik_register_callback(DS_DALVIK_INSN_BEGIN_CB, &DIT_IBCallback, NULL);
  
  if (DIT_handle == DECAF_NULL_HANDLE)
  {
    DECAF_printf("Could not register for Dalvik Instruction Begin \n");
    return (-1);
  }

  return (0);
}
Esempio n. 14
0
static void VirtualAlloc_call(void *opaque)
{
	DECAF_printf("VirtualAlloc entry\n");
	NtCreateFile_hook_context_t *ctx = (NtCreateFile_hook_context_t*)
			malloc(sizeof(NtCreateFile_hook_context_t));
	if(!ctx) //run out of memory
		return;

	DECAF_read_mem(NULL, cpu_single_env->regs[R_ESP], 12*4, ctx->call_stack);
	ctx->hook_handle = hookapi_hook_return(ctx->call_stack[0],
			VirtualAlloc_ret, ctx, sizeof(*ctx));
}
Esempio n. 15
0
void do_instruction_trace(Monitor* monitor, const QDict* qdict)
{
  if (target_cr3 != 0) {
    return;
  }
  DECAF_printf("do_instruction_trace\n");
    if ((qdict != NULL) && (qdict_haskey(qdict, DICT_KEY_PROCNAME))) {
      strncpy(target_name, qdict_get_str(qdict, DICT_KEY_PROCNAME), TARGET_NAME_BUF_SIZE);
      target_name_len = strlen(target_name);
    }
    target_name[TARGET_NAME_BUF_SIZE - 1] = '\0';
}
Esempio n. 16
0
static void createproc_callback(VMI_Callback_Params* params)
{
    if(targetcr3 != 0) //if we have found the process, return immediately
    	return;

	if (strcasecmp(targetname, params->cp.name) == 0) {
		targetpid = params->cp.pid;
		targetcr3 = params->cp.cr3;
		register_hooks();
		DECAF_printf("Process found: pid=%d, cr3=%08x\n", targetpid, targetcr3);
	}
}
Esempio n. 17
0
static int tracing_init(void) {
	int err = 0;

	procname_clear();
	// Parse configuration file
	err = check_ini(ini_main_default_filename);
	if (err) {
		DECAF_printf( "Could not find INI file: %s\n"
				"Use the command 'load_config <filename> to provide it.\n",
				ini_main_default_filename);
	}
	return 0;
}
Esempio n. 18
0
static void instruction_tracer_load_main_module_callback(VMI_Callback_Params* params)
{
  if (target_cr3 != 0) {
    return;
  }
  if (params->cp.name == NULL) {
    return;
  }
  if (strncmp(params->cp.name, target_name, target_name_len) == 0) {
    
    DECAF_printf("Process %s(cr3: %d, pid: %d) you specified starts\n", params->cp.name, params->cp.cr3, params->cp.pid);
    target_cr3 = params->cp.cr3;
    instruction_tracer_cpu_exec_handle
      = DECAF_register_callback(DECAF_CPU_EXEC_CB, &instruction_tracer_cpu_exec_callback, NULL);
    processfinish_handle
      = VMI_register_callback(VMI_REMOVEPROC_CB, &instruction_tracer_process_finished_callback, NULL);

    if ((disas_logfile = fopen(LOGFILE_PATH, "w+")) == NULL) {
      DECAF_printf("log file open error!\n");
    }
  }
}
Esempio n. 19
0
static void DIT_IBCallback(Dalvik_Callback_Params* params)
{
  int insnWidth = 0;
  DecodedInstruction decInsn;
  u2 insns[128];

  if (params == NULL)
  {
    return;
  }
  
  CPUState* env = params->ib.env;
  gva_t rpc = params->ib.dalvik_pc;

  if (getDalvikInstruction(env, rpc, &insnWidth, insns, 128) != 0)
  {
    DECAF_printf("Could not read the instruction at [%x]\n", rpc);
    return;
  }

  if (eLogLevel == LOG_LEVEL_SIMPLE)
  {
    char symbolName[128];

    if (getSymbol(symbolName, 128, getCurrentPID(), rpc) == 0)
    {
      DECAF_printf(" ***** %s ***** \n", symbolName);
    }

    DECAF_printf("[%08x] %s ", rpc, dalvikOpcodeToString(params->ib.opcode));
    int i = 0;
    for (i = 0; i < 8; i++) {
        if (i < insnWidth) {
            if (i == 7) {
                DECAF_printf(" ... ");
            } else {
                /* print 16-bit value in little-endian order */
                const u1* bytePtr = (const u1*) &insns[i];
                DECAF_printf(" %02x%02x", bytePtr[0], bytePtr[1]);
            }
        } else {
            DECAF_printf("     ");
         }
    }
    DECAF_printf("\n");
    return;
  }

  decodeDalvikInstruction(insns, &decInsn);

  dumpDalvikInstruction(stdout, env, insns, 0, insnWidth, &decInsn, 0, rpc, eLogLevel);
  
}
Esempio n. 20
0
static void my_loadmainmodule_notify(VMI_Callback_Params * params) {

	char *name = params->cp.name;
	if (procname_is_set()) {
		if (procname_match(name)) {

			do_tracing_internal(params->cp.pid, tracefile);
			trackproc_start(params->cp.pid);
			DECAF_printf( "Tracing %s\n", procname_get());
			procname_clear();
		}
	}

}
Esempio n. 21
0
void do_tracing(Monitor *mon, const QDict *qdict)
{
  uint32_t pid = qdict_get_int(qdict, "pid");
  const char *filename = qdict_get_str(qdict, "filepath");
  char proc_name[512];
  uint32_t cr3;
  if( VMI_find_process_by_pid_c(pid, proc_name, 512, &cr3)!= -1){
  	  	  procname_set(proc_name);
  		strncpy(tracefile, filename, 256);
  		do_tracing_internal(pid, filename);
  		trackproc_start(pid);
  }
  else
	  DECAF_printf("Unable to find process %d \n", pid);
}
Esempio n. 22
0
/*
 *

NTSTATUS NtCreateFile(
  __out     PHANDLE FileHandle,
  __in      ACCESS_MASK DesiredAccess,
  __in      POBJECT_ATTRIBUTES ObjectAttributes,
  __out     PIO_STATUS_BLOCK IoStatusBlock,
  __in_opt  PLARGE_INTEGER AllocationSize,
  __in      ULONG FileAttributes,
  __in      ULONG ShareAccess,
  __in      ULONG CreateDisposition,
  __in      ULONG CreateOptions,
  __in      PVOID EaBuffer,
  __in      ULONG EaLength
);
 *
 */
void NtCreateFile_ret_handler(void *opaque)
{
	monitor_printf(default_mon, "NtCreateFile_ret\n");
	uint32_t esp, offset;
	uint32_t i,j;
	CPUState *cpu;
	cpu = cpu_single_env;

	UNICODE_STRING ObjectName;
	char *Buffer = NULL;
	ULONG Length=0;
	uint8_t unicode_str[1024];

	POBJECT_ATTRIBUTES po = NULL;


	/* Populate out arguments */
	esp = cpu->regs[R_ESP];
	//offset = esp;
	uint32_t stack_data[11];
	DECAF_read_mem(cpu,esp,4*11,(void *)stack_data);
	uint64_t data_temp=(uint64_t)stack_data[2];
	po = malloc(sizeof(OBJECT_ATTRIBUTES)); ;
	DECAF_read_mem(cpu,stack_data[2],sizeof(OBJECT_ATTRIBUTES),(void *)po);

		if(po->ObjectName){
			DECAF_read_mem(cpu,(uint32_t)po->ObjectName, sizeof(UNICODE_STRING), (void *)&ObjectName);

			monitor_printf(default_mon, "\t\tObjectName.Length: %d\n", ObjectName.Length);
			monitor_printf(default_mon, "\t\tObjectName.MaximumLength: %d\n", ObjectName.MaximumLength);
			monitor_printf(default_mon, "\t\tObjectName.Buffer: 0x%p\n", ObjectName.Buffer);
			if(ObjectName.Buffer && ObjectName.Length){
				Buffer = (char *) malloc (sizeof(char) * ObjectName.Length);
				if(Buffer != '\0') {
					cpu_memory_rw_debug(cpu_single_env, (target_ulong)ObjectName.Buffer, (uint8_t *)&unicode_str, ObjectName.Length, 0);
					for (i = 0, j = 0; i < ObjectName.Length; i+=2, j++)
						Buffer[j] = unicode_str[i];
					Buffer[j] = '\0';
					DECAF_printf("%s\n",Buffer);
					monitor_printf(default_mon, "\t\t\tBuffer: %s \n", Buffer);
					free(Buffer);
				}
			}
		}


}
Esempio n. 23
0
//Cheap copy+paste: do the same as calls, but don't print
void check_ret(DECAF_Callback_Params *param) {
  uint32_t eip, cr3;
  CPUState *env = NULL;

  //If we've gotten this far, params is not null
  if(calls<MAXCALLS) {
    env = param->be.env;
    if(env!=NULL) {
      eip=DECAF_getPC(env);
      cr3=DECAF_getPGD(env);
    } else {
      eip=0x0;
      cr3=0x0;
    }

    DECAF_printf("ret: (0x%x@0x%x)\n", eip-env->sysenter_eip, cr3);
    fprintf(tracefile, "ret: (0x%x@0x%x)\n", eip-env->sysenter_eip, cr3);
  }
}
Esempio n. 24
0
static void do_tracing_by_name_internal(const char *progname,
		const char *filename) {
	/* If process already running, start tracing */
	uint32_t pid = VMI_find_pid_by_name_c(progname);
	uint32_t minus_one = (uint32_t)(-1);
	if (pid != minus_one) {
		procname_set(progname);
		strncpy(tracefile, filename, 256);
		do_tracing_internal(pid, filename);
		trackproc_start(pid);
		return;
	}

	/* Otherwise, start monitoring for process start */
	procname_set(progname);
	strncpy(tracefile, filename, 256);
	DECAF_printf( "Waiting for process %s to start\n", progname);

}
Esempio n. 25
0
static void do_tracing_internal(uint32_t pid, const char *filename) {
	/* if pid = 0, stop trace */
	if (0 == pid)
		tracing_stop();
	else {
		if (!io_logging_initialized) {
			//TODO: fix this -hu
			//netwk_monitor_init(filename);
			io_logging_initialized = 1;
		}
		int retval = tracing_start(pid, filename);
		if (retval < 0)
			DECAF_printf( "Unable to open log file '%s'\n",
					filename);
	}

	/* Print configuration variables */
	//print_conf_vars();
}
Esempio n. 26
0
void DECAF_set_output_file(const char* fileName)
{
  if (ofp != NULL)
  {
    return;
  }

  if (strcmp(fileName, "stdout") == 0)
  {
    DECAF_output_cleanup();
    return;
  }

  //open the file
  ofp = fopen(fileName, "w");
  if (ofp == NULL)
  {
    DECAF_printf("Could not open the file [%s]\n", fileName);
  }
}
Esempio n. 27
0
static void hookapitests_cleanup(void)
{
	// procmod_Callback_Params params;

	DECAF_printf("Bye world\n");

	if (processbegin_handle != DECAF_NULL_HANDLE) {
		VMI_unregister_callback(VMI_CREATEPROC_CB,
				processbegin_handle);
		processbegin_handle = DECAF_NULL_HANDLE;
	}

	if (removeproc_handle != DECAF_NULL_HANDLE) {
		VMI_unregister_callback(VMI_REMOVEPROC_CB, removeproc_handle);
		removeproc_handle = DECAF_NULL_HANDLE;
	}
	if (blockbegin_handle != DECAF_NULL_HANDLE) {
		DECAF_unregister_callback(DECAF_BLOCK_BEGIN_CB, blockbegin_handle);
		blockbegin_handle = DECAF_NULL_HANDLE;
	}

}
Esempio n. 28
0
void block_begin_callback(DECAF_Callback_Params *param) {
  //uint32_t address;
  uint32_t cr3;
  int i, found_cr3=0;
  if(param==NULL) {
    DECAF_printf("Null params!\n");
    return;
  }
  pthread_mutex_lock(&mutex);
  /*
  if(was_int) {
    address = param->bb.env->eip;
    if(use_sysenter)
      address -= param->bb.env->sysenter_eip;
    //fprintf(tracefile, "eip: %x:\n", address);
    was_int--;
  }
  */

  cr3 = DECAF_getPGD(param->be.env);
  if(cr3_changes < CR3_TO_TRACK && cr3 != last_cr3) {
    for(i=0;i<CR3_TO_TRACK;i++) {
      if(cr3s_this_keystroke[i]==cr3) {
        found_cr3=1;
        break;
      }
    }
    //Only increment our global list if this change is unique to the keystroke
    //We are trying to correlate how many CR3s consistently show up
    if(!found_cr3) {
      cr3s_this_keystroke[cr3_changes]=cr3;
      cr3s[cr3>>12]++;
    }
    cr3_changes++;
    last_cr3 = cr3;
  }
Esempio n. 29
0
/**
 * Instruction Begin callback.
 */
void nd_instruction_begin_callback(DECAF_Callback_Params* params){
	DEFENSIVE_CHECK0(params == NULL);
	DEFENSIVE_CHECK0(getCurrentPID() != ND_GLOBAL_TRACING_PID);

	CPUState* env = params->ib.env;
	gva_t cur_pc = params->ib.cur_pc;
	//since for thumb instruction, the last bit is '1'	
	gva_t cur_pc_even = cur_pc & 0xfffffffe;


	if(!nd_in_blacklist(cur_pc_even)){
		return;
	}

	//ARM Instruction
	union _tmpARMInsn{
		target_ulong insn;
		char chars[4];
	} tmpARMInsn;
	//Thumb Instruction
	union _tmpThumbInsn{
		unsigned short insn;
		char chars[2];
	} tmpThumbInsn;
	//Thumb2 Instruction
	union _tmpThumb2Insn{
		target_ulong insn;
		char chars[4];
	} tmpThumb2Insn;

	//undefined instruction
	if(cur_pc == -1){
		return;
	}

	//the first instruction of target native method
	SourcePolicy* sourcePolicy = findSourcePolicy(cur_pc_even);
	if(sourcePolicy != NULL){
		DECAF_printf("Step into Native\n");
		sourcePolicy->handler(sourcePolicy, env);
	}

	//DECAF_printf("%x  %x\n", cur_pc_even, lastCallSysLibAddrRet);

	//return from JNI API calls/system library calls
	if(cur_pc_even == lastCallJNIAddrRet){
		if(lastJniHandler != NULL){
			lastJniHandler(env, 0);
			lastJniHandler = NULL;
			lastCallJNIAddrRet = -1;
		}
	}
	
	if(cur_pc_even == lastCallSysLibAddrRet){
		if(lastSysLibHandler != NULL){
			lastSysLibHandler(env, 0);
			lastSysLibHandler = NULL;
			lastCallSysLibAddrRet = -1;
		}
	}
	
	//Thumb instruction
	if(env->thumb == 1){
		if(DECAF_read_mem(env, cur_pc_even, tmpThumbInsn.chars, 2) != -1){
			darm_t d;
			//darm_str_t str;
    	// magic table constructed based on section A6.1 of the ARM manual
    	static uint8_t is_thumb2[0x20] = {
        [0x01d] = 1,
        [0x01e] = 1,
        [0x01f] = 1,
    	};

			if(is_thumb2[tmpThumbInsn.insn >> 11]){
				//Thumb2 instruction
				if(DECAF_read_mem(env, cur_pc_even, tmpThumb2Insn.chars, 4) != -1){
					if(darm_thumb2_disasm(&d, tmpThumb2Insn.insn & 0x0000ffff, 
								tmpThumb2Insn.insn >> 16, env) == 0){
						//if(darm_str(&d, &str, env) == 0){
							//DECAF_printf("T2  %x: %s\n", cur_pc, str.total);
						//}
					}
				}
			}else{
				//Thumb instruction
				if(darm_thumb_disasm(&d, tmpThumbInsn.insn, env) == 0){
					//if(darm_str(&d, &str, env) == 0){
						//DECAF_printf("T   %x: %s\n", cur_pc, str.total);
					//}
				}
			}
		}
Esempio n. 30
0
inline void get_symbol_address(Monitor* mon, int pid, const char* strModule, const char* strName)
{
  DECAF_printf("%s is at [%x]\n", strName, getSymbolAddress(pid, strModule, strName));
}