int RefFindInRange(duint scanStart, duint scanSize, CBREF Callback, void* UserData, bool Silent, REFINFO & refInfo, Capstone & cp, bool initCallBack, CBPROGRESS cbUpdateProgress) { // Allocate and read a buffer from the remote process Memory<unsigned char*> data(scanSize, "reffind:data"); if(!MemRead(scanStart, data(), scanSize)) { if(!Silent) dprintf("Error reading memory in reference search\n"); return 0; } if(initCallBack) Callback(0, 0, &refInfo); //concurrency::parallel_for(duint (0), scanSize, [&](duint i) for(duint i = 0; i < scanSize;) { // Print the progress every 4096 bytes if((i % 0x1000) == 0) { // Percent = (current / total) * 100 // Integer = floor(percent) int percent = (int)floor(((float)i / (float)scanSize) * 100.0f); cbUpdateProgress(percent); } // Disassemble the instruction int disasmMaxSize = min(MAX_DISASM_BUFFER, (int)(scanSize - i)); // Prevent going past the boundary int disasmLen = 1; if(cp.Disassemble(scanStart, data() + i, disasmMaxSize)) { BASIC_INSTRUCTION_INFO basicinfo; fillbasicinfo(&cp, &basicinfo); if(Callback(&cp, &basicinfo, &refInfo)) refInfo.refcount++; disasmLen = cp.Size(); } else { // Invalid instruction detected, so just skip the byte } scanStart += disasmLen; i += disasmLen; } cbUpdateProgress(100); return refInfo.refcount; }
bool disasmfast(const unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo) { if(!data || !basicinfo) return false; Capstone cp; if(!cp.Disassemble(addr, data, MAX_DISASM_BUFFER)) { strcpy_s(basicinfo->instruction, "???"); basicinfo->size = 1; return false; } fillbasicinfo(&cp, basicinfo); return true; }
bool disasmfast(unsigned char* data, uint addr, BASIC_INSTRUCTION_INFO* basicinfo) { if(!data or !basicinfo) return false; DISASM disasm; memset(&disasm, 0, sizeof(disasm)); #ifdef _WIN64 disasm.Archi = 64; #endif // _WIN64 disasm.EIP = (UIntPtr)data; disasm.VirtualAddr = (UInt64)addr; int len = Disasm(&disasm); if(len == UNKNOWN_OPCODE) return false; fillbasicinfo(&disasm, basicinfo); basicinfo->size = len; return true; }